Apparatus, method and program for detecting abnormal behavior

ABSTRACT

Supplied with a string of vector data as input data, a probabilistic distribution estimation apparatus estimates, by using a stochastic model having hidden variables, a probabilistic distribution in which each data occurs by successively reading the train of vector data. Specifically, the probabilistic distribution estimation apparatus reads values of parameters of the stochastic model having the hidden variables for a value of the input data, calculates, by using the stochastic model, a certainty in which the input data occurs, renews the parameters in response to new read data with past data forgotten, and produce several parameter&#39;s values. By using the parameter&#39;s values received from the probabilistic distribution estimation apparatus, an abnormality detection unit calculates an information amount of data as an abnormal behavior degree to produce the abnormal behavior degree.

CROSS-REFERENCE TO RELATED PATENT APPLICATIONS

This application is a division of application Ser. No. 10/778,178, filedFeb. 17, 2004, now pending, and related to four concurrently filedapplications entitled ABNORMAL BEHAVIOR DETECTION APPARATUS (AttorneyDocket No. 016778-0518), METHOD OF DETECTING ABNORMAL BEHAVIOR (AttorneyDocket No. 016778-0519), APPARATUS AND METHOD OF DETECTING ABNORMALBEHAVIOR (Attorney Docket No. 016778-0520), and APPARATUS AND PROGRAMFOR DETECTING ABNORMAL BEHAVIOR (Attorney Docket No. 016778-0522), andbased on Japanese Patent Application No. 2003-40347, filed Feb. 18,2003, and Japanese Patent Application No. 2003-171481, filed Jun. 17,2003, by Yuko Matsunaga and Kenji Yamanishi, which are incorporatedherein by reference in their entirety. This application claims onlysubject matter disclosed in the parent application and thereforepresents no new matter.

BACKGROUND OF THE INVENTION

This invention relates to a probabilistic distribution estimationapparatus, an abnormal behavior detection apparatus, a probabilisticdistribution estimation method, and an abnormal behavior detectionmethod and, in particular, to a probabilistic distribution estimationapparatus and an abnormal behavior detection apparatus for detectingabnormal behavior which is largely off whole behavior patterns and aprobabilistic distribution estimation method thereof and an abnormalbehavior detection method thereof.

In prior art, proposal has been made several abnormal behavior detectionapparatuses in fields of statistics, data mining, masquerade or disguisedetection, invasion detection, or the like.

At first, an apparatus for detecting abnormality on multidimensionaldata one-point by one-point is disclosed in UK Patent Application No. GB2361336 A under the title of “Degree of outlier calculation device, andprobability density estimation device and histogram calculation devicefor use therein.” According to GB 2361336 A, the apparatus representsthe multidimensional data having discrete values or continuous values ofone-point by one-point using a histogram or a probability densityfunction to carry out detection of statistical outlier values.

Other several abnormal behavior detection apparatuses using behaviordata represented by vector data having a discrete vector value have beenproposed in fields of disguise detection, invasion detection, or thelike as follows.

Invasion detection methods using system call data are described by S.Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff in Proceedingsof the 1996 IEEE Symposium on Security and Privacy, pages 120-128, 1996,under the title of “A sense of self for UNIX Processes,” and by C.Warrender, S. Forrest, and B. Pearlmutter in Proceedings of the 1999IEEE symposium on Security and Privacy, pages 133-145, 1999, under thetitle of “Detecting Intrusions Using System Calls: Alternative DateModels.” A method according to S. Forrest, S. A. Hofmeys, A. Somayaji,and T. A. Longstaff comprises the steps of storing a partial string ofpatterns in system calls where a particular program internally uses onnormality, of matching a string of system calls in a running programwith the partial string to determine whether or not the program isnormal. In addition, a method according to C. Warrender, S. Forrest, andB. Pearlmutter comprises the steps of leaning a string of past systemcalls using a hidden Markov model (HMM) and of determining whether ornot a running program is normal.

Furthermore, a masquerade detection method is described by R. A. Maxionand T. N. Townsend in Proceedings of the International Conference onDependable Systems & Networks, pages 219-228, 2002, under the title of“Masquerade Detection Using Truncated Command Lines.” This methodcomprises the steps of leaning past records or history for commands of aspecific user using a Naive Bayes model and of determining whether ornot current behavior of the user is normal using obtained parameters.

An abnormal behavior detection method using an accessed log of Web isdescribed by I. V. Cadez and P. S. Bradley in Proceedings of the NeuralInformation Processing Systems, pages 1345-1352, 2001, under the titleof “Model Based Population Tracking and Automatic Detection ofDistribution Changes.” This method detects a variation of whole behaviorusing accessed log data of a plurality of users.

In addition, a human abnormal behavior detection system through theimage of a video camera is known in U.S. Pat. No. 6,212,510 issued toMatthew E. brand. This system estimates a behavior model using anentropic prior and a hidden Markov model.

On the other hand, abnormal behavior detection apparatuses usingbehavior data represented by continuous vector data are as follows.

A method for detecting change-points in time series data is described byK. Yamanishi and J. Takeuchi in Proceedings of KDD2002, pages 41-46,2002, under the title of “A unifying Framework for Detecting outliersand change-points from non-stationary time series data.” This methodcomprises the steps of leaning time series data using an autoregressionmodel or the line online and of detecting, as change-points, pointswhere the model largely changes.

A method of finding a characteristic point in continuous time seriesdata is described by X. Ge and P. Smyth in Proceeding of KDD2000, pages81-90, 2000, under the title of “Deformable Markov Model Templates forTime-Series Pattern Matching.” This method comprises the steps ofrepresenting continuous time series data using a distribution model of acontinuous time and a hidden Markov model having a regression modelcorresponding to each state and of detecting, as a characteristic point,the continuous time series data corresponding to a particular state.

In addition, a system for carrying out state estimation of trajectorydata (continuous behavior data) is described by S. Gaffney and P. Smythin Proceedings of KDD1999, pages 63-72, 1999, under the title of“Trajectory Clustering with Mixtures of Regression Models.” This systemcomprises state estimation means which leans trajectory data using afinite mixed distribution of regression models and calculates acertainty where the trajectory data arises from each regression model inthe finite mixed distribution.

However, there are problems in the above-mentioned prior arts asfollows.

A first problem is no adaptability for a variation of an informationsource for generating data in the prior arts. This is because allmethods except for UK Patent Application No. GB 2361336 A and the methodaccording to K. Yamanishi and J. Takeuchi cannot cope with when thepattern changes because all past data are equally dealt with.

A second problem is no sufficient scalability. This is because themethod according to S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A.Longstaff requires a large scale of memory capacity to carry outdetection at a high precision because using a matching. All methodsexcept for UK Patent Application No. GB 2361336 A and the methodaccording to K. Yamanishi and J. Takeuchi are inefficient on calculationas well as necessary of the large scale of memory capacity because aleaning algorithm uses all past data in there methods.

A third problem is no robustness for noises. This is because the methodaccording to S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaffdetermines abnormal for ones which are different from the stored partialstring a little due to use of matching.

A fourth problem is that abnormal behavior enable to detect isrestricted. This is because all of the method according to S. Forrest,S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff, the method according toC. Warrender, S. Forrest, and B. Pearlmutter, and the method accordingto R. A. Maxion and T. N. Townsend which deal with the discrete data aremethods specialized to problems, respectively, and cannot deal withproblems such as occurrence of burst abnormal behavior, a plurality ofprograms, and a plurality of users although they can detect abnormalbehavior in a sense of outlier which is largely off from past behaviorin a single program or a single user. Similarly, the system according toU.S. Pat. No. 6,212,510 can only detect behavior in a sense of outlierfrom a learned model. The method according to I. Cadez and P. S. Bradleycannot detect a variation of individual behavior although the method candetect a variation of whole behavior in the problem for analyzing theaccessed log in a plurality of users. The method according to X. Ge andP. Smyth dealing with the continuous data cannot detect an abnormaltrajectory although the method can detect a characteristic point in thecontinuous time series data where it is understood that it shouldpreliminarily be paid attention. The method according to S. Gaffney andP. Smyth cannot detect an abnormal trajectory although the methodcomprises trajectory state estimation means.

A fifth problem is that precision of detection is bad in a case of fewdata. The method according to S. Forrest, S. A. Hofmeyr, A. Somayaji,and T. A. Longstaff, the method according to C. Warrender, S. Forrest,and B. Pearlmutter, and the method according to R. A. Maxion and T. N.Townsend cannot detect abnormal behavior in the single program or thesingle user at a high precision when there is no sufficient amount ofpast data.

A sixth problem is that data of analysis target is restricted. Thesystem according to UK Patent Application No. GB 2361336 A cannot detectabnormal behavior although the system can detect the discrete data orthe continuous data one-point by one-point in a sense of outlier fromthe learned model. Likewise, the system according to K. Yamanishi and J.Takeuchi cannot detect abnormality in a pattern of behavior dataalthough the system can detect outlier or a variation point in thediscrete data or the continuous data one-point by one-point.

SUMMARY OF THE INVENTION

It is a first object of this invention to provide a probabilisticdistribution estimation apparatus and method which is capable ofadaptively estimating a probabilistic distribution in which each dataoccurs at robust for noises by successively reading a number of vectordata representing behavior using an oblivious type algorithm and to anabnormal behavior detection apparatus and method for detecting abnormalbehavior using the estimated probabilistic distribution.

It is a second object of this invention to provide a probabilisticdistribution estimation apparatus and method and an abnormal behaviordetection apparatus and method which are capable of detecting avariation of behavior meaning burst abnormal behavior using an abnormalbehavior degree with distinction of abnormal behavior in a sense ofoutlier of a pattern.

It is a third object of this invention to provide a probabilisticdistribution estimation apparatus and method and an abnormal behaviordetection apparatus and method which are capable, in a problem dealingwith behavior data into which a plurality of programs or data of aplurality of users are mixed, not only of detecting a variation ofindividual behavior but also of detecting abnormal behavior data at ahigh precision when the behavior data is few.

It is a fourth object of this invention to provide a probabilisticdistribution estimation apparatus and method and an abnormal behaviordetection apparatus and method which are capable of detecting avariation of structure of whole behavior models.

Other objects of this invention will become clear as the descriptionproceeds.

According to a first aspect of this invention, a probabilisticdistribution estimation apparatus is for responding to, as input data, astring of vector data to estimate, using a stochastic model havinghidden variables, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data. The probabilisticdistribution estimation apparatus comprises a parameter storage unit forstoring all of parameters for the stochastic model having the hiddenvariables, a certainty calculation arrangement for calculating, inresponse to input data, a certainty where the input data occurs usingthe stochastic model by reading the parameters of the stochastic modelfrom the parameter storage unit, a parameter renewal arrangementrenewing contents of the parameter storage unit in accordance with newread data with past data forgotten by reading the certainty from thecertainty calculation means and by reading each parameter of thestochastic model from the parameter storage unit, and an outputtingarrangement for outputting several parameters of the stochastic modelstored in the parameter storage unit.

In the first aspect of this invention, the probabilistic distributionestimation apparatus preferably may further comprise a sessionarrangement for processing the input data into the string of vectordata.

According to a second aspect of this invention, a probabilisticdistribution estimation apparatus is for responding to, as input data, astring of vector data to estimate, using a time series model having acontinuous time distribution and hidden variables, a probabilisticdistribution occurred in each data by successively reading the string ofthe vector data. The probabilistic distribution estimation apparatuscomprises a parameter storage unit for storing all of parameters for thetime series model having the continuous time distribution and the hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the time series model by reading the parameters of the time seriesmodel from the parameter storage unit, a parameter renewal arrangementfor renewing contents of the parameter storage unit in accordance withnew read data with past data forgotten by reading the certainty from thecertainty calculation arrangement and by reading each parameter of thetime series model from the parameter storage unit, and an outputtingarrangement for outputting several parameters of the time series modelstored in the parameter storage unit.

In the second aspect of this invention, the probabilistic distributionestimation apparatus preferably may further comprise a sessionarrangement for processing the input data into the string of vectordata.

According to a third aspect of this invention, a probabilisticdistribution estimation apparatus is for responding to, as input data, astring of vector data to estimate, using a finite mixed distribution ofhidden Macrov models each having a continuous time distribution, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data. The probabilistic distribution estimationapparatus comprises a parameter storage unit for storing all ofparameters for the finite mixed distribution of said hidden Marcovmodels each having the continuous distribution, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the finite mixed distribution of thehidden Macrov models by reading the parameters of the finite mixeddistribution of the hidden Marcov models from said parameter storageunit, a parameter renewal arrangement for renewing contents of theparameter storage unit in accordance with new read data with past dataforgotten by reading the certainty from the certainty calculationarrangement and by reading each parameter of the finite mixeddistribution of the hidden Marcov models from the parameter storageunit, and an outputting arrangement for outputting several parameters ofthe finite mixed distribution of the hidden Marcov models stored in theparameter storage unit.

In the third aspect of this invention, the probabilistic distributionestimation apparatus preferably may further comprise a sessionarrangement for processing the input data into the string of vectordata.

According to a fourth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a stochastic model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the stochasticmodel having hidden variables, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the stochastic model by reading the parameters of thestochastic model from the parameter storage unit, and a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation means and by reading eachparameter of the stochastic model from the parameter storage unit. Astate estimation arrangement uses the parameters of the probabilisticdistribution estimated by the probabilistic distribution estimationapparatus to produce, as a score, the certainty where the new read datahas a state corresponding to each hidden variable of the stochasticmodel.

According to a fifth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a stochastic model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises asession arrangement for processing the input data into the string ofvector data, a parameter storage unit for storing all of parameters forthe stochastic model having hidden variables, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the stochastic model by reading theparameters of the stochastic model from the parameter storage unit, anda parameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading each parameter of the stochastic model from the parameterstorage unit. A state estimation arrangement uses the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus to produce, as a score, the certainty where the newread data has a state corresponding to each hidden variable of thestochastic model.

According to a sixth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a stochastic model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the stochasticmodel having hidden variables, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the stochastic model by reading the parameters of thestochastic model from the parameter storage unit, and a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the stochastic model from the parameter storage unit. Anabnormality detection arrangement calculates information amount of thenew read data by using the parameters of the probabilistic distributionestimated by the probabilistic distribution estimation apparatus toproduce an abnormal behavior degree of the new read data.

In the sixth aspect of this invention, the abnormal behavior detectionapparatus may further comprise a behavior model variation degreecalculation unit for calculating, by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation unit, a variation degree of a behavior mode as a time-averageof the abnormal behavior degrees for a predetermined width by reading aplurality of new data.

According to a seventh aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a stochastic model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises asession arrangement for processing the input data into the string ofvector data, a parameter storage unit for storing all of parameters forthe stochastic model having hidden variables, a certainty calculationarrangement for calculating, in response to input data, a certaintywhere the input data occurs using the stochastic model by reading theparameters of the stochastic model from the parameter storage unit, anda parameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading each parameter of the stochastic model from said parameterstorage unit. An abnormality detection arrangement calculatesinformation amount of the new read data by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus to produce an abnormal behavior degree of the newread data.

In the seventh aspect of this invention, the abnormal behavior detectionapparatus may further comprise a behavior model variation degreecalculation unit for calculating, by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation unit, a variation degree of a behavior mode as a time-averageof the abnormal behavior degrees for a predetermined width by reading aplurality of new data.

According to an eighth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a stochastic model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the stochasticmodel having hidden variables, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the stochastic model by reading the parameters of thestochastic model from the parameter storage unit, and a parameterrenewal means for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the stochastic model having the respective hidden variablesfrom the parameter storage unit. A posteriori probability calculationarrangement calculates a posteriori probability of the statecorresponding to the hidden variables by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus. A reference data input unit inputs data differentfrom the input data. A posteriori probability variation degreecalculation arrangement calculates a variation of the posterioridistribution and outputting it by using the posteriori distribution ofthe state corresponding to the hidden variables calculated by theposteriori distribution calculation arrangement on the basis of the dataread out of the reference data input unit and by using the posterioridistribution of the state corresponding to the hidden variablescalculated by the posteriori distribution calculation arrangement on thebasis of the new read data.

According to a ninth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a stochastic model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises asession arrangement for processing the input data into the string ofvector data, a parameter storage unit for storing all of parameters forthe stochastic model having hidden variables, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the stochastic model by reading theparameters of the stochastic model from the parameter storage unit, anda parameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading each parameter of the stochastic model having the respectivehidden variables from the parameter storage unit, a posterioriprobability calculation arrangement for calculating a posterioriprobability of the state corresponding to the hidden variables by usingthe parameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, a reference data inputunit for inputting data different from the input data, and a posterioriprobability variation degree calculation arrangement for calculating avariation of the posteriori distribution and outputting it by using theposteriori distribution of the state corresponding to the hiddenvariables calculated by the posteriori distribution calculation means onthe basis of the data read out of the reference data input unit and byusing the posteriori distribution of the state corresponding to thehidden variables calculated by the posteriori distribution calculationarrangement on the basis of the new read data.

According to a tenth aspect of this invention, an abnormal behaviordetection apparatus comprises a plurality of probabilistic distributionestimation apparatuses each of which responds to, as input data, astring of vector data to estimate, using a stochastic model, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data. Each of the probabilistic distributionestimation apparatuses comprises a parameter storage unit for storingall of parameters for the stochastic model having hidden variables, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where said input data occurs using thestochastic model by reading the parameters of the stochastic model fromthe parameter storage unit, and a parameter renewal arrangement forrenewing contents of the parameter storage unit in accordance with newread data with past data forgotten by reading the certainty from thecertainty calculation arrangement and by reading each parameter of thestochastic model from the parameter storage unit. An information amountstandard calculation arrangement calculates, by using, in parallel, theplurality of probabilistic distribution estimation apparatuses for thestochastic models having different number of the states where the hiddenvariables can take, standard values of information amount from theparameters of the probabilistic distributions estimated by therespective probabilistic distribution estimation apparatuses and theinput data to produce, as an optimum value, the number of states wherethe hidden variables can take when the standard value of the informationamount is the least.

According to an eleventh aspect of this invention, an abnormal behaviordetection apparatus comprises a plurality of probabilistic distributionestimation apparatuses each of which responds to, as input data, astring of vector data to estimate, using a stochastic model, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data. Each of the probabilistic distributionestimation apparatuses comprises a session arrangement for processingthe input data into the string of vector data, a parameter storage unitfor storing all of parameters for the stochastic model having hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the stochastic model by reading the parameters of the stochasticmodel from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the stochastic model from the parameter storage unit. Aninformation amount standard calculation arrangement calculates, byusing, in parallel, the plurality of probabilistic distributionestimation apparatuses for the stochastic models having different numberof the states where the hidden variables can take, standard values ofinformation amount from the parameters of the probabilisticdistributions estimated by the respective probabilistic distributionestimation apparatuses and the input data to produce, as an optimumvalue, the number of states where the hidden variables can take when thestandard value of the information amount is the least.

According to a twelfth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a time series model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the time seriesmodel having a continuous time distribution and hidden variables, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where the input data occurs using the timeseries model by reading the parameters of the time series model from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation means and by reading the parameters of the time series modelfrom the parameter storage unit. A state estimation arrangement uses theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus to produce, as a score,the certainty where the new read data has a state corresponding to eachhidden variable of the time series model.

According to a thirteenth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a time series model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises asession arrangement for processing the input data into the string ofvector data, a parameter storage unit for storing all of parameters forthe time series model having a continuous time distribution and hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the time series model by reading the parameters of the time seriesmodel from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the time series model from the parameter storage unit. Astate estimation arrangement uses the parameters of the probabilisticdistribution estimated by the probabilistic distribution estimationapparatus to produce, as a score, the certainty where the new read datahas a state corresponding to each hidden variable of the time seriesmodel.

According to a fourteenth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a time series model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the time seriesmodel having a continuous time distribution and hidden variables, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where the input data occurs using the timeseries model by reading the parameters of the time series model from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation arrangement and by reading the parameters of the time seriesmodel from the parameter storage unit. An abnormality detectionarrangement calculates information amount of the new read data by usingthe parameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus to produce an abnormalbehavior degree of the new read data.

In the fourteenth aspect of this invention, an abnormal behaviordetection apparatus may further comprise a behavior model variationdegree calculation unit for calculating, by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation unit, a variation degree of a behavior mode as a time-averageof the abnormal behavior degrees for a predetermined width by reading aplurality of new data.

According to a fifteenth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a time series model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises asession arrangement for processing the input data into the string ofvector data, a parameter storage unit for storing all of parameters forthe time series model having a continuous time distribution and hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the time series model by reading the parameters of the time seriesmodel from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the time series model from the parameter storage unit. Anabnormality detection arrangement calculates information amount of thenew read data by using the parameters of the probabilistic distributionestimated by the probabilistic distribution estimation apparatus toproduce an abnormal behavior degree of the new read data.

According to the fifteenth aspect of this invention, an abnormalbehavior detection apparatus may further comprise a behavior modelvariation degree calculation unit for calculating, by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation unit, a variation degree of abehavior mode as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data.

According to a sixteenth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a time series model, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the time seriesmodel having a continuous time distribution and hidden variables, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where the input data occurs using the timeseries model by reading the parameters of the time series model from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation arrangement and by reading the parameters of the time seriesmodel from the parameter storage unit. A posteriori probabilitycalculation arrangement calculates a posteriori probability of the statecorresponding to the hidden variables by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus. A reference data input unit inputs data differentfrom the input data. A posteriori probability variation degreecalculation arrangement calculates a variation of the posterioridistribution and outputting it by using the posteriori distribution ofthe state corresponding to the hidden variables calculated by theposteriori distribution calculation arrangement on the basis of the dataread out of the reference data input unit and by using the posterioridistribution of the state corresponding to the hidden variablescalculated by the posteriori distribution calculation mean on the basisof the new read data.

According to a seventeenth aspect of this invention, an abnormalbehavior detection apparatus comprises a probabilistic distributionestimation apparatus for responding to, as input data, a string ofvector data to estimate, using a time series model, a probabilisticdistribution occurred in each data by successively reading the string ofthe vector data. The probabilistic distribution estimation apparatuscomprises a session arrangement for processing the input data into thestring of vector data, a parameter storage unit for storing all ofparameters for the time series model having a continuous timedistribution and hidden variables, a certainty calculation arrangementfor calculating, in response to the input data, a certainty where theinput data occurs using the time series model by reading the parametersof the time series model from the parameter storage unit, and aparameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading the parameters of the time series model from the parameterstorage unit. A posteriori probability calculation arrangementcalculates a posteriori probability of the state corresponding to thehidden variables by using the parameters of the probabilisticdistribution estimated by the probabilistic distribution estimationapparatus. A reference data input unit inputs data different from theinput data. A posteriori probability variation degree calculationarrangement calculates a variation of the posteriori distribution andoutputting it by using the posteriori distribution of the statecorresponding to the hidden variables calculated by the posterioridistribution calculation means on the basis of the data read out of thereference data input unit and by using the posteriori distribution ofthe state corresponding to the hidden variables calculated by theposteriori distribution calculation arrangement on the basis of the newread data.

According to an eighteenth aspect of this invention, an abnormalbehavior detection apparatus comprises a plurality of probabilisticdistribution estimation apparatuses each of which responds to, as inputdata, a string of vector data to estimate, using a time series model, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data. Each of the probabilistic distributionestimation apparatuses comprises a parameter storage unit for storingall of parameters for the time series model having a continuous timedistribution and hidden variables, a certainty calculation arrangementfor calculating, in response to the input data, a certainty where theinput data occurs using the time series model by reading the parametersof the time series model from the parameter storage unit, and aparameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading the parameters of the time series model from the parameterstorage unit. An information amount standard calculation arrangementcalculates, by using, in parallel, the plurality of probabilisticdistribution estimation apparatuses for the time series models havingdifferent number of the states where the hidden variables can take,standard values of information amount from the parameters of theprobabilistic distributions estimated by the respective probabilisticdistribution estimation apparatuses and the input data to produce, as anoptimum value, the number of states where the hidden variables can takewhen the standard value of the information amount is the least.

According to a nineteenth aspect of this invention, an abnormal behaviordetection apparatus comprises a plurality of probabilistic distributionestimation apparatuses each of which responds to, as input data, astring of vector data to estimate, using a time series model, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data. Each of the probabilistic distributionestimation apparatuses comprises a session arrangement for processingthe input data into the string of vector data, a parameter storage unitfor storing all of parameters for the time series model having acontinuous time distribution and hidden variables, a certaintycalculation arrangement for calculating, in response to the input data,a certainty where the input data occurs using the time series model byreading the parameters of the time series model from the parameterstorage unit, and a parameter renewal arrangement for renewing contentsof the parameter storage unit in accordance with new read data with pastdata forgotten by reading the certainty from the certainty calculationarrangement and by reading the parameters of the time series model fromthe parameter storage unit. An information amount standard calculationarrangement calculates, by using, in parallel, the plurality ofprobabilistic distribution estimation apparatuses for the time seriesmodels having different number of the states where the hidden variablescan take, standard values of information amount from the parameters ofthe probabilistic distributions estimated by the respectiveprobabilistic distribution estimation apparatuses and the input data toproduce, as an optimum value, the number of states where the hiddenvariables can take when the standard value of the information amount isthe least.

According to a twentieth aspect of this invention, an abnormal behaviordetection apparatus comprises a probabilistic distribution estimationapparatus for responding to, as input data, a string of vector data toestimate, using a finite mixed distribution of hidden Marcov models, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data. The probabilistic distribution estimationapparatus comprises a parameter storage unit for storing all ofparameters for the finite mixed distribution of the hidden Marcov modelseach having a continuous time distribution, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the finite mixed distribution of thehidden Marcov models by reading the parameters of the finite mixeddistribution of the hidden Marcov models from the parameter storageunit, and a parameter renewal arrangement for renewing contents of theparameter storage unit in accordance with new read data with past dataforgotten by reading the certainty from the certainty calculation meansand by reading the parameters of the finite mixed distribution of thehidden Marcov models from said parameter storage unit. A stateestimation arrangement uses the parameters of the probabilisticdistribution estimated by the probabilistic distribution estimationapparatus to produce, as a score, the certainty where the new read datahas a state corresponding to each hidden variable of the finite mixeddistribution of the hidden Marcov models.

According to a twenty-first aspect of this invention, an abnormalbehavior detection apparatus comprises a probabilistic distributionestimation apparatus for responding to, as input data, a string ofvector data to estimate, using a finite mixed distribution of hiddenMarcov models, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data. The probabilisticdistribution estimation apparatus comprises a session arrangement forprocessing the input data into the string of vector data, a parameterstorage unit for storing all of parameters for the finite mixeddistribution of the hidden Marcov models each having a continuous timedistribution, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the finite mixed distribution of the hidden Marcov models byreading the parameters of the finite mixed distribution of the hiddenMarcov models from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit. A state estimation arrangement uses theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus to produce, as a score,the certainty where the new read data has a state corresponding to eachhidden variable of the finite mixed distribution of the hidden Marcovmodels.

According to a twenty-second aspect of this invention, an abnormalbehavior detection apparatus comprises a probabilistic distributionestimation apparatus for responding to, as input data, a string ofvector data to estimate, using a finite mixed distribution of hiddenMarcov models, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data. The probabilisticdistribution estimation apparatus comprises a parameter storage unit forstoring all of parameters for the finite mixed distribution of thehidden Marcov models each having a continuous time distribution, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where the input data occurs using the finitemixed distribution of the hidden Marcov models by reading the parametersof the finite mixed distribution of the hidden Marcov models from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation arrangement and by reading the parameters of the finitemixed distribution of the hidden Marcov models from the parameterstorage unit. An abnormality detection arrangement calculates aninformation amount of the new read data by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus to produce an abnormal behavior degree of the newread data.

In the twenty-second aspect of this invention, an abnormal behaviordetection apparatus may further comprise a behavior model variationdegree calculation unit for calculating, by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation unit, a variation degree of a behavior mode as a time-averageof the abnormal behavior degrees for a predetermined width by reading aplurality of new data.

According to a twenty-third aspect of this invention, an abnormalbehavior detection apparatus comprises a probabilistic distributionestimation apparatus for responding to, as input data, a string ofvector data to estimate, using a finite mixed distribution of hiddenMarcov models, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data. The probabilisticdistribution estimation apparatus comprises a session arrangement forprocessing the input data into the string of vector data, a parameterstorage unit for storing all of parameters for the finite mixeddistribution of the hidden Marcov models each having a continuous timedistribution, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the finite mixed distribution of the hidden Marcov models byreading the parameters of the finite mixed distribution of the hiddenMarcov models from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit. An abnormality detection arrangementcalculates an information amount of the new read data by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus to produce an abnormalbehavior degree of the new read data.

In the twenty-third aspect of this invention, the abnormal behaviordetection apparatus may further comprise a behavior model variationdegree calculation unit for calculating, by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus, a variation degree of a behavior mode as atime-average of the abnormal behavior degrees for a predetermined widthby reading a plurality of new data.

According to a twenty-fourth aspect of this invention, an abnormalbehavior detection apparatus comprises a probabilistic distributionestimation apparatus for responding to, as input data, a string ofvector data to estimate, using a finite mixed distribution of hiddenMarcov models, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data. The probabilisticdistribution estimation apparatus comprises a parameter storage unit forstoring all of parameters for the finite mixed distribution of thehidden Marcov models each having a continuous time distribution, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where said input data occurs using the finitemixed distribution of the hidden Marcov models by reading the parametersof the finite mixed distribution of the hidden Marcov models from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation arrangement and by reading the parameters of the finitemixed distribution of the hidden Marcov models from the parameterstorage unit. A posteriori probability calculation arrangementcalculates a posteriori probability of the state corresponding to thehidden variables by using the parameters of the probabilisticdistribution estimated by the probabilistic distribution estimationapparatus. A reference data input unit inputs data different from saidinput data. A posteriori probability variation degree calculationarrangement calculates a variation of the posteriori distribution andoutputting it by using the posteriori distribution of the statecorresponding to the hidden variables calculated by the posterioridistribution calculation arrangement on the basis of the data read outof the reference data input unit and by using the posterioridistribution of the state corresponding to the hidden variablescalculated by the posteriori distribution calculation arrangement on thebasis of the new read data.

According to a twenty-fifth aspect of this invention, an abnormalbehavior detection apparatus comprises a probabilistic distributionestimation apparatus for responding to, as input data, a string ofvector data to estimate, using a finite mixed distribution of hiddenMarcov models, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data. The probabilisticdistribution estimation apparatus comprises a session arrangement forprocessing the input data into the string of vector data, a parameterstorage unit for storing all of parameters for the finite mixeddistribution of the hidden Marcov models each having a continuous timedistribution, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the finite mixed distribution of the hidden Marcov models byreading the parameters of the finite mixed distribution of the hiddenMarcov models from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation means and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit. A posteriori probability calculationarrangement calculates a posteriori probability of the statecorresponding to the hidden variables by using the parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus. A reference data input unit inputs data differentfrom the input data. A posteriori probability variation degreecalculation arrangement calculates a variation of the posterioridistribution and outputting it by using the posteriori distribution ofthe state corresponding to the hidden variables calculated by theposteriori distribution calculation arrangement on the basis of the dataread out of the reference data input unit and by using the posterioridistribution of the state corresponding to the hidden variablescalculated by the posteriori distribution calculation mean on the basisof the new read data.

According to a twenty-sixth aspect of this invention, an abnormalbehavior detection apparatus comprises a plurality of probabilisticdistribution estimation apparatuses each of which responds to, as inputdata, a string of vector data to estimate, using a finite mixeddistribution of hidden Marcov models, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. Each of the probabilistic distribution estimation apparatusescomprises a parameter storage unit for storing all of parameters for thefinite mixed distribution of the hidden Marcov models each having acontinuous time distribution, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the finite mixed distribution of the hidden Marcovmodels by reading the parameters of the finite mixed distribution of thehidden Marcov models from the parameter storage unit, and a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit. An information amount standardcalculation arrangement calculates, by using, in parallel, the pluralityof probabilistic distribution estimation apparatuses for the finitemixed distributions of the hidden Marcov models having different numberof the states where the hidden variables can take, standard values ofinformation amounts from the parameters of the probabilisticdistributions estimated by the respective probabilistic distributionestimation apparatuses and the input data to produce, as an optimumvalue, the number of states where the hidden variables can take when thestandard value of the information amount is the least.

According to a twenty-seventh aspect of this invention, an abnormalbehavior detection apparatus comprises a plurality of probabilisticdistribution estimation apparatuses each of which responds to, as inputdata, a string of vector data to estimate, using a finite mixeddistribution of hidden Marcov models, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata. Each of the probabilistic distribution estimation apparatusescomprises a session arrangement for processing the input data into thestring of vector data, a parameter storage unit for storing all ofparameters for the finite mixed distribution of the hidden Marcov modelseach having a continuous time distribution, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the finite mixed distribution of thehidden Marcov models by reading the parameters of the finite mixeddistribution of the hidden Marcov models from the parameter storageunit, and a parameter renewal arrangement for renewing contents of theparameter storage unit in accordance with new read data with past dataforgotten by reading the certainty from the certainty calculationarrangement and by reading the parameters of the finite mixeddistribution of the hidden Marcov models from the parameter storageunit. An information amount standard calculation arrangement calculates,by using, in parallel, the plurality of probabilistic distributionestimation apparatuses for the finite mixed distributions of the hiddenMarcov models having different number of the states where the hiddenvariables can take, standard values of information amounts from theparameters of the probabilistic distributions estimated by therespective probabilistic distribution estimation apparatuses and theinput data to produce, as an optimum value, the number of states wherethe hidden variables can take when the standard value of the informationamount is the least.

According to a twenty-eighth aspect of this invention, a probabilisticdistribution estimation method comprises the steps of inputting a stringof vector data as input data, of calculating, using a stochastic modelhaving hidden variables as a probabilistic distribution in which eachdata occurs by successively reading the string of vector data, acertainty for a value of the input data in which the input data occurson the basis of parameters of the stochastic model, of renewing, byusing the certainty and the parameters of the stochastic model, theparameters in response to new read data with past data forgotten, and ofoutputting several values of the calculated parameters.

In the twenty-eighth aspect of this invention, the probabilisticdistribution estimation method may further comprise the step of carryingout session for converting the input data into the vector data when theinput data has no structure of vector data.

According to a twenty-ninth aspect of this invention, a probabilisticdistribution estimation method comprises the steps of inputting a stringof vector data as input data, of calculating, using a time series modelhaving a continuous time distribution and hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for value of the inputdata in which the input data occurs on the basis of parameters of thetime series model, of renewing, by using the certainty and theparameters of the time series model, the parameters in response to newread data with past data forgotten, and of outputting several values ofthe calculated parameters.

In the twenty-ninth aspect of this invention, the probabilisticdistribution estimation method may further comprise the step of carryingout session for converting said input data into the vector data when theinput data has no structure of vector data.

According to a thirty aspect of this invention, a probabilisticdistribution estimation method comprises the steps of inputting a stringof vector data as input data, of calculating, using a finite mixeddistribution of hidden Marcov models each having a continuous timedistribution as a probabilistic distribution in which each data occursby successively reading the string of vector data, a certainty for avalue of the input data in which the input data occurs on the basis ofparameters of the finite mixed distribution of the hidden Marcov models,of renewing, by using the certainty and the parameters of the finitemixed distribution of the hidden Marcov models, the parameters inresponse to new read data with past data forgotten, and of outputtingseveral values of the calculated parameters.

In the thirty aspect of this invention, the probabilistic distributionestimation method may further comprise the step of carrying out sessionfor converting the input data into the vector data when the input datahas no structure of vector data.

According to a thirty aspect of this invention, an abnormal behaviordetection method comprises the steps of inputting a string of vectordata as input data, of calculating, using a stochastic model havinghidden variables as a probabilistic distribution in which each dataoccurs by successively reading the string of vector data, a certaintyfor a value of the input data in which the input data occurs on thebasis of parameters of the stochastic model, of renewing, by using thecertainty and the parameters of the stochastic model, the parameters inresponse to new read data with past data forgotten, and of outputting,by using parameters of an estimated probabilistic distribution, as ascore, the certainty where new read data has a state corresponding toeach hidden variable.

According to a thirty-first aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a stochastic model having hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thestochastic model, of renewing, by using the certainty and the parametersof the stochastic model, the parameters in response to new read datawith past data forgotten, and of outputting, by using parameters of anestimated probabilistic distribution, as a score, the certainty wherenew read data has a state corresponding to each hidden variable.

According to a thirty-second aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of calculating, using a stochastic modelhaving hidden variables as a probabilistic distribution in which eachdata occurs by successively reading the string of vector data, acertainty for a value of the input data in which the input data occurson the basis of parameters of the stochastic model, of renewing, byusing the certainty and the parameters of the stochastic model, theparameters in response to new read data with past data forgotten, and ofcalculating, by using parameters of an estimated probabilisticdistribution, an abnormal behavior degree of new read data usinginformation amount of the new read data to produce the abnormal behaviordegree.

In the thirty-second aspect of this invention, the abnormal behaviordetection method may further comprise the step of calculating, by usingthe parameters of the estimated probabilistic distribution, a variationdegree of a behavior model as a time-average of the abnormal behaviordegrees for a predetermined width by reading a plurality of data.

According to a thirty-third aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a stochastic model having hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thestochastic model, of renewing, by using the certainty and the parametersof the stochastic model, the parameters in response to new read datawith past data forgotten, and of calculating, by using parameters of anestimated probabilistic distribution, an abnormal behavior degree of newread data using information amount of the new read data to produce theabnormal behavior degree.

In the thirty-third aspect of this invention, the abnormal behaviordetection method may further comprise the step of calculating, by usingthe parameters of the estimated probabilistic distribution, a variationdegree of a behavior model as a time-average of the abnormal behaviordegrees for a predetermined width by reading a plurality of data.

According to a thirty-fourth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, calculating, using a stochastic model havinghidden variables as a probabilistic distribution in which each dataoccurs by successively reading the string of vector data, a certaintyfor a value of the input data in which the input data occurs on thebasis of parameters of the stochastic model, renewing, by using thecertainty and the parameters of the stochastic model, the parameters inresponse to new read data with past data forgotten, of calculating, byusing parameters of an estimated probabilistic distribution, a firstposteriori probability of a state corresponding to the hidden variablesby reading reference data different from the input data, of calculating,by using the parameters of the estimated probabilistic distribution, asecond posteriori probability of a state corresponding to the hiddenvariables by reading new read data as the input data, and ofcalculating, as a variation of a posteriori probability, a differencebetween the first and the second posteriori probabilities to produce thevariation of the posteriori probability.

According to a thirty-fifth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a stochastic model having hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thestochastic model, of renewing, by using the certainty and the parametersof the stochastic model, the parameters in response to new read datawith past data forgotten, of calculating, by using parameters of anestimated probabilistic distribution, a first posteriori probability ofa state corresponding to the hidden variables by reading reference datadifferent from the input data, of calculating, by using the parametersof the estimated probabilistic distribution, a second posterioriprobability of a state corresponding to the hidden variables by readingnew read data as the input data, and of calculating, as a variation of aposteriori probability, a difference between the first and the secondposteriori probabilities to produce the variation of the posterioriprobability.

According to a thirty-sixth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of estimating, in parallel, parameters forstochastic models having hidden variables of different number of statesby using a plurality of probabilistic distribution estimationapparatuses, and of calculating, by using the parameters and the inputdata, standard values of information amounts for the respectivestochastic models to produce, as an optimum value, the number of thestates where the hidden variables can take when the standard value ofthe information amount is the least.

In the abnormal behavior detection method according to the thirty-sixthaspect of this invention, the above-mentioned estimating step in eachprobabilistic distribution estimation apparatus may comprise the stepsof calculating, using the stochastic model having hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thestochastic model, of renewing, by using the certainty and the parametersof the stochastic model, the parameters in response to new read datawith past data forgotten, and of outputting several values of thecalculated parameters.

In the abnormal behavior detection method according to the thirty-sixthaspect of this invention, the above-mentioned estimating step in eachprobabilistic distribution estimation apparatus may comprise the stepsof carrying out session for converting the input data into the string ofvector data when the input data have no structure of vector data, ofcalculating, using the stochastic model having hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thestochastic model, of renewing, by using the certainty and the parametersof the stochastic model, the parameters in response to new read datawith past data forgotten, and of outputting several values of thecalculated parameters.

According to a thirty-seventh aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of calculating, using a time series modelhaving a continuous time distribution and hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thetime series model, of renewing, by using the certainty and theparameters of the time series model, the parameters in response to newread data with past data forgotten, and of outputting, by usingparameters of an estimated probabilistic distribution, as a score, thecertainty where new read data has a state corresponding to each hiddenvariable of the time series model.

According to a thirty-eighth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a time series model having a continuous timedistribution and hidden variables as a probabilistic distribution inwhich each data occurs by successively reading the string of vectordata, a certainty for a value of the input data in which the input dataoccurs on the basis of parameters of the time series model, of renewing,by using the certainty and the parameters of the time series model, theparameters in response to new read data with past data forgotten, and ofoutputting, by using parameters of an estimated probabilisticdistribution, as a score, the certainty where new read data has a statecorresponding to each hidden variable of the time series model.

According to a thirty-ninth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of calculating, using a time series modelhaving a continuous time distribution and hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thetime series model, of renewing, by using the certainty and theparameters of the time series model, the parameters in response to newread data with past data forgotten, and of calculating, by usingparameters of an estimated probabilistic distribution, an abnormalbehavior degree of new read data using information amount of the newread data to produce the abnormal behavior degree.

In the thirty-ninth aspect of this invention, the abnormal behaviordetection method may further comprise the step of calculating, by usingthe parameters of the estimated probabilistic distribution, a variationdegree of a behavior model as a time-average of the abnormal behaviordegrees for a predetermined width by reading a plurality of data.

According to a forty aspect of this invention, an abnormal behaviordetection method comprises the steps of inputting input data, ofcarrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a time series model having a continuous timedistribution and hidden variables as a probabilistic distribution inwhich each data occurs by successively reading the string of vectordata, a certainty for a value of the input data in which the input dataoccurs on the basis of parameters of the time series model, of renewing,by using the certainty and the parameters of the time series model, theparameters in response to new read data with past data forgotten, and ofcalculating, by using parameters of an estimated probabilisticdistribution, an abnormal behavior degree of new read data usinginformation amount of the new read data to produce the abnormal behaviordegree.

In the forty aspect of this invention, the abnormal behavior detectionmethod may the step of calculating, by using the parameters of theestimated probabilistic distribution, a variation degree of a behaviormodel as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of data.

According to a forty-first aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of calculating, using a time series modelhaving a continuous time distribution and hidden variables as aprobabilistic distribution in which each data occurs by successivelyreading the string of vector data, a certainty for a value of the inputdata in which the input data occurs on the basis of parameters of thetime series model, of renewing, by using the certainty and theparameters of the time series model, the parameters in response to newread data with past data forgotten, of calculating, by using parametersof an estimated probabilistic distribution, a first posterioriprobability of a state corresponding to the hidden variables by readingreference data different from the input data, of calculating, by usingthe parameters of the estimated probabilistic distribution, a secondposteriori probability of a state corresponding to the hidden variablesby reading new read data as the input data, and of calculating, as avariation of a posteriori probability, a difference between the firstand the second posteriori probabilities to produce the variation of theposteriori probability.

According to a forty-second aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a time series model having a continues timedistribution and hidden variables as a probabilistic distribution inwhich each data occurs by successively reading the string of vectordata, a certainty for a value of the input data in which the input dataoccurs on the basis of parameters of the time series model, of renewing,by using the certainty and the parameters of the time series model, theparameters in response to new read data with past data forgotten, ofcalculating, by using parameters of an estimated probabilisticdistribution, a first posteriori probability of a state corresponding tothe hidden variables by reading reference data different from the inputdata, of calculating, by using the parameters of the estimatedprobabilistic distribution, a second posteriori probability of a statecorresponding to the hidden variables by reading new read data as theinput data, and of calculating, as a variation of a posterioriprobability, a difference between the first and the second posterioriprobabilities to produce the variation of the posteriori probability.

According to a forty-third aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of estimating, in parallel, parameters fortime series models having continues time distributions and hiddenvariables of different number of states by using a plurality ofprobabilistic distribution estimation apparatuses, and of calculating,by using the parameters and the input data, standard values ofinformation amount for the respective stochastic models to produce, asan optimum value, the number of the states where the hidden variablescan take when the standard value of the information amount is the least.

In the abnormal behavior detection method according to the forty-thirdaspect of this invention, the above-mentioned estimating step in eachprobabilistic distribution estimation apparatus may comprise the stepsof calculating, using the time series model having the continuous timedistribution and the hidden variables as a probabilistic distribution inwhich each data occurs by successively reading the string of vectordata, a certainty for a value of the input data in which said input dataoccurs on the basis of parameters of the stochastic model, of renewing,by using the certainty and the parameters of said time series model, theparameters in response to new read data with past data forgotten, and ofoutputting several values of the calculated parameters.

In the abnormal behavior detection method according to the forty-thirdaspect of this invention, the above-mentioned estimating step in eachprobabilistic distribution estimation apparatus may comprise the stepsof carrying out session for converting the input data into the string ofvector data when the input data have no structure of vector data, ofcalculating, using the time series model having the continuous timedistribution and the hidden variables as a probabilistic distribution inwhich each data occurs by successively reading the string of vectordata, a certainty for a value of the input data in which the input dataoccurs on the basis of parameters of the stochastic model, of renewing,by using the certainty and the parameters of the time series model, theparameters in response to new read data with past data forgotten, and ofoutputting several values of the calculated parameters.

According to a forty-fourth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of calculating, using a finite mixeddistribution of hidden Marcov models each having a continuous timedistribution as a probabilistic distribution in which each data occursby successively reading the string of vector data, a certainty for avalue of the input data in which the input data occurs on the basis ofparameters of the finite mixed distribution of the hidden Marcov models,of renewing, by using the certainty and the parameters of the finitemixed distribution of the hidden Marcov models, the parameters inresponse to new read data with past data forgotten, and of outputting,by using parameters of an estimated probabilistic distribution, as ascore, the certainty where new read data has a state corresponding toeach hidden variable of the finite mixed distribution of the hiddenMarcov models.

According to a forty-fifth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a finite mixed distribution of hidden Marcov modelseach having a continuous time distribution as a probabilisticdistribution in which each data occurs by successively reading thestring of vector data, a certainty for a value of the input data inwhich the input data occurs on the basis of parameters of the finitemixed distribution of the hidden Marcov models, of renewing, by usingthe certainty and the parameters of the finite mixed distribution of thehidden Marcov models, the parameters in response to new read data withpast data forgotten, and of outputting, by using parameters of anestimated probabilistic distribution, as a score, the certainty wherenew read data has a state corresponding to each hidden variable of thefinite mixed distribution of the hidden Marcov models.

According to a forty-sixth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of calculating, using a finite mixeddistribution of hidden Marcov models each having a continuous timedistribution as a probabilistic distribution in which each data occursby successively reading the string of vector data, a certainty for avalue of the input data in which the input data occurs on the basis ofparameters of the finite mixed distribution of the hidden Marcov models,of renewing, by using the certainty and the parameters of the finitemixed distribution of the hidden Marcov models, the parameters inresponse to new read data with past data forgotten, and of calculating,by using parameters of an estimated probabilistic distribution, anabnormal behavior degree of new read data using information amount ofthe new read data to produce the abnormal behavior degree.

In the forty-sixth aspect of this invention, the abnormal behaviordetection method may further comprise the step of calculating, by usingthe parameters of the estimated probabilistic distribution, a variationdegree of a behavior model as a time-average of the abnormal behaviordegrees for a predetermined width by reading a plurality of data.

According to a forty-seventh aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a finite mixed distribution of hidden Marcov modelseach having a continuous time distribution as a probabilisticdistribution in which each data occurs by successively reading thestring of vector data, a certainty for a value of the input data inwhich the input data occurs on the basis of parameters of the finitemixed distribution of the hidden Marcov models, of renewing, by usingthe certainty and the parameters of the finite mixed distribution of thehidden Marcov models, the parameters in response to new read data withpast data forgotten, and of calculating, by using parameters of anestimated probabilistic distribution, an abnormal behavior degree of newread data using information amount of the new read data to produce theabnormal behavior degree.

In the forty-seventh aspect of this invention, the abnormal behaviordetection method may further comprise the step of calculating, by usingthe parameters of the estimated probabilistic distribution, a variationdegree of a behavior model as a time-average of the abnormal behaviordegrees for a predetermined width by reading a plurality of data.

According to a forty-eighth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting a string ofvector data as input data, of calculating, using a finite mixeddistribution of hidden Marcov models each having a continuous timedistribution as a probabilistic distribution in which each data occursby successively reading the string of vector data, a certainty for avalue of the input data in which the input data occurs on the basis ofparameters of the finite mixed distribution of the hidden Marcov models,of renewing, by using the certainty and the parameters of the finitemixed distribution of the hidden Marcov models, the parameters inresponse to new read data with past data forgotten, of calculating, byusing parameters of an estimated probabilistic distribution, a firstposteriori probability of a state corresponding to the hidden variablesby reading reference data different from the input data, of calculating,by using the parameters of the estimated probabilistic distribution, asecond posteriori probability of a state corresponding to the hiddenvariables by reading new read data as the input data, and ofcalculating, as a variation of a posteriori probability, a differencebetween the first and the second posteriori probabilities to produce thevariation of the posteriori probability.

According to a forty-ninth aspect of this invention, an abnormalbehavior detection method comprises the steps of inputting input data,of carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using a finite mixed distribution of hidden Marcov modelseach having a continues time distribution as a probabilisticdistribution in which each data occurs by successively reading thestring of vector data, a certainty for a value of the input data inwhich the input data occurs on the basis of parameters of the finitemixed distribution of the hidden Marcov models, of renewing, by usingsaid certainty and the parameters of the finite mixed distribution ofthe hidden Marcov models, the parameters in response to new read datawith past data forgotten, of calculating, by using parameters of anestimated probabilistic distribution, a first posteriori probability ofa state corresponding to the hidden variables by reading reference datadifferent from the input data, of calculating, by using the parametersof the estimated probabilistic distribution, a second posterioriprobability of a state corresponding to the hidden variables by readingnew read data as the input data, and of calculating, as a variation of aposteriori probability, a difference between the first and the secondposteriori probabilities to produce the variation of the posterioriprobability.

According to a fifty aspect of this invention, an abnormal behaviordetection method comprises the steps of inputting a string of vectordata as input data, of estimating, in parallel, parameters for finitemixed distributions of hidden Marcov models each having a continuos timedistribution of different number of states by using a plurality ofprobabilistic distribution estimation apparatuses, and of calculating,by using the parameters and the input data, standard values ofinformation amount for the respective stochastic models to produce, asan optimum value, the number of the states where the hidden variablescan take when the standard value of the information amount is the least.

In the abnormal behavior detection method according to the fifty aspectof this invention, the above-mentioned estimating step in eachprobabilistic distribution estimation apparatus may comprise the stepsof calculating, using the finite mixed distribution of the hidden Marcovmodels each having the continuous time distribution as a probabilisticdistribution in which each data occurs by successively reading thestring of vector data, a certainty for a value of the input data inwhich said input data occurs on the basis of parameters of the finitemixed distribution of the hidden Marcov models, of renewing, by usingthe certainty and the parameters of the finite mixed distribution of thehidden Marcov models, the parameters in response to new read data withpast data forgotten, and of outputting several values of said calculatedparameters.

In the abnormal behavior detection method according to the fifty aspectof this invention, the above-mentioned estimating step in eachprobabilistic distribution estimation apparatus may comprise the stepsof carrying out session for converting the input data into a string ofvector data when the input data have no structure of vector data, ofcalculating, using the finite mixed distribution of the hidden Marcovmodels each having the continuous time distribution as a probabilisticdistribution in which each data occurs by successively reading thestring of vector data, a certainty for a value of the input data inwhich the input data occurs on the basis of parameters of the finitemixed distribution of the hidden Marcov models, of renewing, by usingthe certainty and the parameters of the finite mixed distribution of thehidden Marcov models, the parameters in response to new read data withpast data forgotten, and of outputting several values of said calculatedparameters.

According to a fifty-first aspect of this invention, a probabilisticdistribution estimation program if for making a computer respond to, asinput data, a string of vector data to estimate, using a stochasticmodel having hidden variables, a probabilistic distribution occurred ineach data by successively reading the string of the vector data. Theprobabilistic distribution estimation program makes the computer operateas a parameter storage unit for storing all of parameters for thestochastic model having the hidden variables, as a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the stochastic model by reading theparameters of the stochastic model from the parameter storage unit, as aparameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading each parameter of the stochastic model from the parameterstorage unit, and as an outputting arrangement for outputting severalparameters of the stochastic model stored in the parameter storage unit.

In the fifty-first aspect of this invention, the probabilisticdistribution estimation program may further make the program operate asa session arrangement for processing the input data into the string ofvector data.

According to a fifty-second aspect of this invention, a probabilisticdistribution estimation program is for making a computer respond to, asinput data, a string of vector data to estimate, using a time seriesmodel having a continuous time distribution and hidden variables, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data. The probabilistic distribution estimationprogram makes the computer operate as a parameter storage unit forstoring all of parameters for the time series model having thecontinuous time distribution and the hidden variables, as a certaintycalculation arrangement for calculating, in response to the input data,a certainty where the input data occurs using the time series model byreading the parameters of the time series model from the parameterstorage unit, as a parameter renewal arrangement for renewing contentsof the parameter storage unit in accordance with new read data with pastdata forgotten by reading the certainty from the certainty calculationmeans and by reading each parameter of the time series model from theparameter storage unit, and as an outputting arrangement for outputtingseveral parameters of the time series model stored in the parameterstorage unit.

In the fifty-second aspect of this invention, the probabilisticdistribution estimation program may further make the program operate asa session arrangement for processing the input data into the string ofvector data.

According to a fifty-third aspect of this invention, a probabilisticdistribution estimation program is for making a computer respond to, asinput data, a string of vector data to estimate, using a finite mixeddistribution of hidden Macrov models each having a continuous timedistribution, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data. The probabilisticdistribution estimation program makes the computer operate as aparameter storage unit for storing all of parameters for the finitemixed distribution of the hidden Marcov models each having thecontinuous distribution, as a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the finite mixed distribution of the hidden Macrovmodels by reading the parameters of the finite mixed distribution of thehidden Marcov models from the parameter storage unit, as a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the finite mixed distribution of said hidden Marcov modelsfrom the parameter storage unit, and as an outputting arrangement foroutputting several parameters of the finite mixed distribution of thehidden Marcov models stored in the parameter storage unit.

In the fifty-third aspect of this invention, the probabilisticdistribution estimation program may further make the program operate asa session arrangement for processing the input data into the string ofvector data.

According to a fifty-fourth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a stochasticmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as a stateestimation arrangement. The probabilistic distribution estimationapparatus comprises a parameter storage unit for storing all ofparameters for the stochastic model having hidden variables, a certaintycalculation arrangement for calculating, in response to the input data,a certainty where the input data occurs using the stochastic model byreading the parameters of the stochastic model from the parameterstorage unit, and a parameter renewal arrangement for renewing contentsof the parameter storage unit in accordance with new read data with pastdata forgotten by reading the certainty from the certainty calculationarrangement and by reading each parameter of the stochastic model fromthe parameter storage unit. The state estimation arrangement uses theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus to produce, as a score,the certainty where the new read data has a state corresponding to eachhidden variable of the stochastic model.

According to a fifty-fifth aspect of this invention, an abnormalbehavior detection program is for making a computer as a probabilisticdistribution estimation apparatus for responding to, as input data, astring of vector data to estimate, using a stochastic model, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data and as a state estimation arrangement. Theprobabilistic distribution estimation apparatus comprises a sessionarrangement for processing the input data into the string of vectordata, a parameter storage unit for storing all of parameters for thestochastic model having hidden variables, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the stochastic model by reading theparameters of the stochastic model from the parameter storage unit, anda parameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading each parameter of the stochastic model from the parameterstorage unit. The state estimation arrangement uses the parameters ofthe probabilistic distribution estimated by the probabilisticdistribution estimation apparatus to produce, as a score, the certaintywhere the new read data has a state corresponding to each hiddenvariable of the stochastic model.

According to a fifty-sixth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a stochasticmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as an abnormalitydetection arrangement for calculating an information amount of new readdata by using parameters of the probabilistic distribution estimated bythe probabilistic distribution estimation apparatus to produce anabnormal behavior degree of the new read data. The probabilisticdistribution estimation apparatus comprises a parameter storage unit forstoring all of parameters for the stochastic model having hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the stochastic model by reading the parameters of the stochasticmodel from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the stochastic model from the parameter storage unit.

In the fifty-sixth aspect of this invention, the abnormal behaviordetection program may further make the computer as operate as a behaviormodel variation degree calculation unit for calculating, by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation unit, a variation degree of abehavior mode as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data.

According to a fifty-seventh aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a stochasticmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as an abnormalitydetection arrangement for calculating an information amount of new readdata by using parameters of the probabilistic distribution estimated bythe probabilistic distribution estimation apparatus to produce anabnormal behavior degree of the new read data. The probabilisticdistribution estimation apparatus comprises a session arrangement forprocessing the input data into the string of vector data, a parameterstorage unit for storing all of parameters for the stochastic modelhaving hidden variables, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the stochastic model by reading the parameters of thestochastic model from the parameter storage unit, and a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the stochastic model from the parameter storage unit.

In the fifty-seventh aspect of this invention, the abnormal behaviordetection program may further make the computer as operate as a behaviormodel variation degree calculation unit for calculating, by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, a variation degree of abehavior mode as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data.

According to a fifty-eighth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a stochasticmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data, as a posterioriprobability calculation arrangement for calculating a posterioriprobability of a state corresponding to the hidden variables by usingparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, as a reference datainput unit for inputting data different from the input data, and as aposteriori probability variation degree calculation arrangement forcalculating a variation of the posteriori distribution and outputting itby using the posteriori distribution of the state corresponding to thehidden variables calculated by the posteriori distribution calculationarrangement on the basis of the data read out of the reference datainput unit and by using the posteriori distribution of a statecorresponding to the hidden variables calculated by the posterioridistribution calculation arrangement on the basis of the new read data.The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the stochasticmodel having hidden variables, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the stochastic model by reading the parameters of thestochastic model from the parameter storage unit, and as a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation means and by reading eachparameter of the stochastic model having the respective hidden variablesfrom the parameter storage unit.

According to a fifty-ninth aspect of this invention, an abnormalbehavior detection apparatus is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a stochasticmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data, as a posterioriprobability calculation arrangement for calculating a posterioriprobability of a state corresponding to the hidden variables by usingparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, as a reference datainput unit for inputting data different from the input data, and as aposteriori probability variation degree calculation arrangement forcalculating a variation of the posteriori distribution and outputting itby using the posteriori distribution of the state corresponding to thehidden variables calculated by the posteriori distribution calculationarrangement on the basis of the data read out of the reference datainput unit and by using the posteriori distribution of the statecorresponding to the hidden variables calculated by the posterioridistribution calculation mean on the basis of the new read data. Theprobabilistic distribution estimation apparatus comprises a sessionarrangement for processing the input data into the string of vectordata, a parameter storage unit for storing all of parameters for thestochastic model having hidden variables, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the stochastic model by reading theparameters of the stochastic model from the parameter storage unit, anda parameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading each parameter of the stochastic model having the respectivehidden variables from the parameter storage unit;

According to a sixtieth aspect of this invention, an abnormal behaviordetection program is for making a computer operate as a plurality ofprobabilistic distribution estimation apparatuses each of which respondsto, as input data, a string of vector data to estimate, using astochastic model, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as an informationamount standard calculation arrangement for calculating, by using, inparallel, the plurality of probabilistic distribution estimationapparatuses for the stochastic models having different number of thestates where the hidden variables can take, standard values ofinformation amount from parameters of the probabilistic distributionsestimated by the respective probabilistic distribution estimationapparatuses and the input data to produce, as an optimum value, thenumber of states where the hidden variables can take when the standardvalue of the information amount is the least. Each of the probabilisticdistribution estimation apparatuses comprises a parameter storage unitfor storing all of parameters for the stochastic model having hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the stochastic model by reading the parameters of the stochasticmodel from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the stochastic model from the parameter storage unit.

According to a sixty-first aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aplurality of probabilistic distribution estimation apparatuses each ofwhich responds to, as input data, a string of vector data to estimate,using a stochastic model, a probabilistic distribution occurred in eachdata by successively reading the string of the vector data an as aninformation amount standard calculation arrangement for calculating, byusing, in parallel, the plurality of probabilistic distributionestimation apparatuses for the stochastic models having different numberof states where the hidden variables can take, standard values ofinformation amounts from parameters of the probabilistic distributionsestimated by the respective probabilistic distribution estimationapparatuses and the input data to produce, as an optimum value, thenumber of states where the hidden variables can take when the standardvalue of the information amount is the least. Each of the probabilisticdistribution estimation apparatuses comprises a session arrangement forprocessing the input data into the string of vector data, a parameterstorage unit for storing all of parameters for the stochastic modelhaving hidden variables, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the stochastic model by reading the parameters of thestochastic model from the parameter storage unit, and a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading eachparameter of the stochastic model from the parameter storage unit.

According to a sixty-second aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a time seriesmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as a stateestimation arrangement. The probabilistic distribution estimationapparatus comprises a parameter storage unit for storing all ofparameters for the time series model having a continuous timedistribution and hidden variables, a certainty calculation arrangementfor calculating, in response to the input data, a certainty where theinput data occurs using the time series model by reading the parametersof the time series model from the parameter storage unit, and aparameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading the parameters of the time series model from the parameterstorage unit. The state estimation arrangement uses the parameters ofthe probabilistic distribution estimated by the probabilisticdistribution estimation apparatus to produce, as a score, the certaintywhere the new read data has a state corresponding to each hiddenvariable of the time series model.

According to a sixty-third aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a time seriesmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as a stateestimation arrangement. The probabilistic distribution estimationapparatus comprises a session arrangement for processing the input datainto the string of vector data, a parameter storage unit for storing allof parameters for the time series model having a continuous timedistribution and hidden variables, a certainty calculation arrangementfor calculating, in response to the input data, a certainty where theinput data occurs using the time series model by reading the parametersof the time series model from the parameter storage unit, and aparameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading the parameters of the time series model from the parameterstorage unit. The state estimation arrangement uses the parameters ofthe probabilistic distribution estimated by the probabilisticdistribution estimation apparatus to produce, as a score, the certaintywhere the new read data has a state corresponding to each hiddenvariable of the time series model.

According to a sixty-third aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a time seriesmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as an abnormalitydetection arrangement for calculating an information amount of new readdata by using parameters of the probabilistic distribution estimated bythe probabilistic distribution estimation apparatus to produce anabnormal behavior degree of the new read data. The probabilisticdistribution estimation apparatus comprises a parameter storage unit forstoring all of parameters for the time series model having a continuoustime distribution and hidden variables, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the time series model by reading theparameters of the time series model from the parameter storage unit, anda parameter renewal arrangement for renewing contents of the parameterstorage unit in accordance with new read data with past data forgottenby reading the certainty from the certainty calculation arrangement andby reading the parameters of the time series model from the parameterstorage unit.

In the sixty-third aspect of this invention, the abnormal behaviordetection program may further make the computer as operate as a behaviormodel variation degree calculation unit for calculating, by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation unit, a variation degree of abehavior mode as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data.

According to a sixty-fourth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a time seriesmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data and as an abnormalitydetection arrangement for calculating an information amount of new readdata by using parameters of the probabilistic distribution estimated bythe probabilistic distribution estimation apparatus to produce anabnormal behavior degree of the new read data. The probabilisticdistribution estimation apparatus comprises a session arrangement forprocessing the input data into the string of vector data, a parameterstorage unit for storing all of parameters for the time series modelhaving a continuous time distribution and hidden variables, a certaintycalculation arrangement for calculating, in response to the input data,a certainty where the input data occurs using the time series model byreading the parameters of the time series model from the parameterstorage unit, and a parameter renewal arrangement for renewing contentsof the parameter storage unit in accordance with new read data with pastdata forgotten by reading the certainty from the certainty calculationarrangement and by reading the parameters of the time series model fromthe parameter storage unit.

In the sixty-fourth aspect of this invention, the abnormal behaviordetection program may further make the computer as operate as a behaviormodel variation degree calculation unit for calculating, by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation unit, a variation degree of abehavior mode as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data.

According to a sixty-fifth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a time seriesmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data, as a posterioriprobability calculation arrangement for calculating a posterioriprobability of a state corresponding to the hidden variables by usingparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, as a reference datainput unit for inputting data different from the input data, and as aposteriori probability variation degree calculation arrangement forcalculating a variation of the posteriori distribution and outputting itby using the posteriori distribution of the state corresponding to thehidden variables calculated by the posteriori distribution calculationarrangement on the basis of the data read out of the reference datainput unit and by using the posteriori distribution of the statecorresponding to the hidden variables calculated by the posterioridistribution calculation arrangement on the basis of the new read data.The probabilistic distribution estimation apparatus comprises aparameter storage unit for storing all of parameters for the time seriesmodel having a continuous time distribution and hidden variables, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where the input data occurs using the timeseries model by reading the parameters of the time series model from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation arrangement and by reading the parameters of the time seriesmodel from the parameter storage unit;

According to a sixty-sixth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a time seriesmodel, a probabilistic distribution occurred in each data bysuccessively reading the string of the vector data, a posterioriprobability calculation arrangement for calculating a posterioriprobability of a state corresponding to the hidden variables by usingparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, as a reference datainput unit for inputting data different from the input data, and as aposteriori probability variation degree calculation arrangement forcalculating a variation of the posteriori distribution and outputting itby using the posteriori distribution of the state corresponding to thehidden variables calculated by the posteriori distribution calculationarrangement on the basis of the data read out of the reference datainput unit and by using the posteriori distribution of the statecorresponding to the hidden variables calculated by the posterioridistribution calculation arrangement on the basis of the new read data.The probabilistic distribution estimation apparatus comprises a sessionarrangement for processing the input data into the string of vectordata, a parameter storage unit for storing all of parameters for thetime series model having a continuous time distribution and hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the time series model by reading the parameters of the time seriesmodel from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation means and by reading theparameters of the time series model from the parameter storage unit.

According to a sixty-seventh aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aplurality of probabilistic distribution estimation apparatuses each ofwhich responds to, as input data, a string of vector data to estimate,using a time series model, a probabilistic distribution occurred in eachdata by successively reading the string of the vector data and as aninformation amount standard calculation arrangement for calculating, byusing, in parallel, the plurality of probabilistic distributionestimation apparatuses for the time series models having differentnumber of states where the hidden variables can take, standard values ofinformation amounts from parameters of the probabilistic distributionsestimated by the respective probabilistic distribution estimationapparatuses and the input data to produce, as an optimum value, thenumber of states where the hidden variables can take when the standardvalue of the information amount is the least. Each of the probabilisticdistribution estimation apparatuses comprises a parameter storage unitfor storing all of parameters for the time series model having acontinuous time distribution and hidden variables, a certaintycalculation arrangement for calculating, in response to the input data,a certainty where the input data occurs using the time series model byreading the parameters of the time series model from the parameterstorage unit, and a parameter renewal arrangement for renewing contentsof the parameter storage unit in accordance with new read data with pastdata forgotten by reading the certainty from the certainty calculationarrangement and by reading the parameters of the time series model fromthe parameter storage unit.

According to a sixty-eighth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aplurality of probabilistic distribution estimation apparatuses each ofwhich responds to, as input data, a string of vector data to estimate,using a time series model, a probabilistic distribution occurred in eachdata by successively reading the string of the vector data and as aninformation amount standard calculation arrangement for calculating, byusing, in parallel, the plurality of probabilistic distributionestimation apparatuses for the time series models having differentnumber of the states where the hidden variables can take, standardvalues of information amounts from the parameters of the probabilisticdistributions estimated by the respective probabilistic distributionestimation apparatuses and the input data to produce, as an optimumvalue, the number of states where the hidden variables can take when thestandard value of the information amount is the least. Each of theprobabilistic distribution estimation apparatuses comprises a sessionarrangement for processing the input data into the string of vectordata, a parameter storage unit for storing all of parameters for thetime series model having a continuous time distribution and hiddenvariables, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the time series model by reading the parameters of the time seriesmodel from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the time series model from the parameter storage unit.

According to a sixty-ninth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a finite mixeddistribution of hidden Marcov models, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata and as a state estimation arrangement. The probabilisticdistribution estimation apparatus comprises a parameter storage unit forstoring all of parameters for the finite mixed distribution of thehidden Marcov models each having a continuous time distribution, acertainty calculation arrangement for calculating, in response to theinput data, a certainty where the input data occurs using the finitemixed distribution of the hidden Marcov models by reading the parametersof the finite mixed distribution of the hidden Marcov models from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation arrangement and by reading the parameters of the finitemixed distribution of the hidden Marcov models from the parameterstorage unit. The state estimation arrangement uses the parameters ofthe probabilistic distribution estimated by the probabilisticdistribution estimation apparatus to produce, as a score, the certaintywhere the new read data has a state corresponding to each hiddenvariable of the finite mixed distribution of the hidden Marcov models.

According to a seventieth aspect of this invention, an abnormal behaviordetection program is for making a computer operate as a probabilisticdistribution estimation apparatus for responding to, as input data, astring of vector data to estimate, using a finite mixed distribution ofhidden Marcov models, a probabilistic distribution occurred in each databy successively reading the string of the vector data and a stateestimation arrangement. The probabilistic distribution estimationapparatus comprises a session arrangement for processing the input datainto the string of vector data, a parameter storage unit for storing allof parameters for the finite mixed distribution of said hidden Marcovmodels each having a continuous time distribution, a certaintycalculation arrangement for calculating, in response to the input data,a certainty where the input data occurs using the finite mixeddistribution of the hidden Marcov models by reading the parameters ofthe finite mixed distribution of said hidden Marcov models from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation arrangement and by reading the parameters of the finitemixed distribution of the hidden Marcov models from the parameterstorage unit. The state estimation arrangement uses the parameters ofthe probabilistic distribution estimated by the probabilisticdistribution estimation apparatus to produce, as a score, the certaintywhere the new read data has a state corresponding to each hiddenvariable of the finite mixed distribution of the hidden Marcov models.

According to a seventy-first aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a finite mixeddistribution of hidden Marcov models, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata and as an abnormality detection arrangement for calculating aninformation amount of new read data by using parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus to produce an abnormal behavior degree of the newread data. The probabilistic distribution estimation apparatus comprisesa parameter storage unit for storing all of parameters for the finitemixed distribution of the hidden Marcov models each having a continuoustime distribution, a certainty calculation means for calculating, inresponse to the input data, a certainty where the input data occursusing the finite mixed distribution of the hidden Marcov models byreading the parameters of the finite mixed distribution of the hiddenMarcov models from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit.

In the seventy-first aspect of this invention, the abnormal behaviordetection program may further make the computer as operate as a behaviormodel variation degree calculation unit for calculating, by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, a variation degree of abehavior mode as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data.

According to a seventy-second aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a finite mixeddistribution of hidden Marcov models, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata and as an abnormality detection arrangement for calculating aninformation amount of new read data by using parameters of theprobabilistic distribution estimated by the probabilistic distributionestimation apparatus to produce an abnormal behavior degree of the newread data. The probabilistic distribution estimation apparatus comprisesa session arrangement for processing the input data into the string ofvector data, a parameter storage unit for storing all of parameters forthe finite mixed distribution of the hidden Marcov models each having acontinuous time distribution, a certainty calculation arrangement forcalculating, in response to the input data, a certainty where the inputdata occurs using the finite mixed distribution of the hidden Marcovmodels by reading the parameters of the finite mixed distribution of thehidden Marcov models from the parameter storage unit, and a parameterrenewal arrangement for renewing contents of the parameter storage unitin accordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit.

In the seventy-second aspect of this invention, the abnormal behaviordetection program may further make the computer as operate as a behaviormodel variation degree calculation unit for calculating, by using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus, a variation degree of abehavior mode as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data.

According to a seventy-third aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a finite mixeddistribution of hidden Marcov models, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata, as a posteriori probability calculation arrangement forcalculating a posteriori probability of a state corresponding to thehidden variables by using parameters of the probabilistic distributionestimated by the probabilistic distribution estimation apparatus, as areference data input unit for inputting data different from the inputdata, and as a posteriori probability variation degree calculationarrangement for calculating a variation of the posteriori distributionand outputting it by using the posteriori distribution of the statecorresponding to the hidden variables calculated by the posterioridistribution calculation arrangement on the basis of the data read outof the reference data input unit and by using the posterioridistribution of the state corresponding to the hidden variablescalculated by the posteriori distribution calculation arrangement on thebasis of the new read data. The probabilistic distribution estimationapparatus comprises a parameter storage unit for storing all ofparameters for the finite mixed distribution of the hidden Marcov modelseach having a continuous time distribution, a certainty calculationarrangement for calculating, in response to the input data, a certaintywhere the input data occurs using the finite mixed distribution of thehidden Marcov models by reading the parameters of the finite mixeddistribution of the hidden Marcov models from the parameter storageunit, and a parameter renewal arrangement for renewing contents of theparameter storage unit in accordance with new read data with past dataforgotten by reading the certainty from the certainty calculation meansand by reading the parameters of the finite mixed distribution of thehidden Marcov models from the parameter storage unit.

According to a seventy-fourth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aprobabilistic distribution estimation apparatus for responding to, asinput data, a string of vector data to estimate, using a finite mixeddistribution of hidden Marcov models, a probabilistic distributionoccurred in each data by successively reading the string of the vectordata, as a posteriori probability calculation arrangement forcalculating a posteriori probability of a state corresponding to thehidden variables by using parameters of the probabilistic distributionestimated by the probabilistic distribution estimation apparatus, as areference data input unit for inputting data different from the inputdata, and as a posteriori probability variation degree calculationarrangement for calculating a variation of the posteriori distributionand outputting it by using the posteriori distribution of the statecorresponding to the hidden variables calculated by the posterioridistribution calculation arrangement on the basis of the data read outof the reference data input unit and by using the posterioridistribution of the state corresponding to the hidden variablescalculated by the posteriori distribution calculation mean on the basisof the new read data. The probabilistic distribution estimationapparatus comprises a session arrangement for processing the input datainto the string of vector data, a parameter storage unit for storing allof parameters for the finite mixed distribution of the hidden Marcovmodels each having a continuous time distribution, a certaintycalculation arrangement for calculating, in response to the input data,a certainty where the input data occurs using the finite mixeddistribution of the hidden Marcov models by reading the parameters ofthe finite mixed distribution of the hidden Marcov models from theparameter storage unit, and a parameter renewal arrangement for renewingcontents of the parameter storage unit in accordance with new read datawith past data forgotten by reading the certainty from the certaintycalculation means and by reading the parameters of the finite mixeddistribution of the hidden Marcov models from the parameter storageunit.

According to a seventy-fifth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aplurality of probabilistic distribution estimation apparatuses each ofwhich responds to, as input data, a string of vector data to estimate,using a finite mixed distribution of hidden Marcov models, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data and as an information amount standardcalculation arrangement for calculating, by using, in parallel, theplurality of probabilistic distribution estimation apparatuses for thefinite mixed distributions of the hidden Marcov models having differentnumber of the states where the hidden variables can take, standardvalues of information amounts from the parameters of the probabilisticdistributions estimated by the respective probabilistic distributionestimation apparatuses and the input data to produce, as an optimumvalue, the number of states where the hidden variables can take when thestandard value of the information amount is the least. Each of theprobabilistic distribution estimation apparatuses comprises a parameterstorage unit for storing all of parameters for the finite mixeddistribution of the hidden Marcov models each having a continuous timedistribution, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the finite mixed distribution of the hidden Marcov models byreading the parameters of the finite mixed distribution of the hiddenMarcov models from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation arrangement and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit.

According to a seventy-sixth aspect of this invention, an abnormalbehavior detection program is for making a computer operate as aplurality of probabilistic distribution estimation apparatuses each ofwhich responds to, as input data, a string of vector data to estimate,using a finite mixed distribution of hidden Marcov models, aprobabilistic distribution occurred in each data by successively readingthe string of the vector data and as an information amount standardcalculation arrangement for calculating, by using, in parallel, theplurality of probabilistic distribution estimation apparatuses for thefinite mixed distributions of the hidden Marcov models having differentnumber of states where the hidden variables can take, standard values ofinformation amounts from parameters of the probabilistic distributionsestimated by the respective probabilistic distribution estimationapparatuses and the input data to produce, as an optimum value, thenumber of states where the hidden variables can take when the standardvalue of the information amount is the least. Each of the probabilisticdistribution estimation apparatuses comprises a session arrangement forprocessing the input data into the string of vector data, a parameterstorage unit for storing all of parameters for the finite mixeddistribution of the hidden Marcov models each having a continuous timedistribution, a certainty calculation arrangement for calculating, inresponse to the input data, a certainty where the input data occursusing the finite mixed distribution of the hidden Marcov models byreading the parameters of the finite mixed distribution of the hiddenMarcov models from the parameter storage unit, and a parameter renewalarrangement for renewing contents of the parameter storage unit inaccordance with new read data with past data forgotten by reading thecertainty from the certainty calculation. arrangement and by reading theparameters of the finite mixed distribution of the hidden Marcov modelsfrom the parameter storage unit.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a block diagram of a probabilistic distribution estimationapparatus according to a first embodiment of this invention;

FIG. 2 is a flow chart for use in describing operation of theprobabilistic distribution estimation apparatus illustrated in FIG. 1;

FIG. 3 shows a block diagram of a probabilistic distribution estimationapparatus according to a second embodiment of this invention;

FIG. 4 is a flow chart for use in describing operation of theprobabilistic distribution estimation apparatus illustrated in FIG. 3;

FIG. 5 shows a block diagram of an abnormal behavior detection apparatusaccording to a third embodiment of this invention;

FIG. 6 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus illustrated in FIG. 5;

FIG. 7 shows a block diagram of an abnormal behavior detection apparatusaccording to a fourth embodiment of this invention;

FIG. 8 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus illustrated in FIG. 7;

FIG. 9 shows a block diagram of an abnormal behavior detection apparatusaccording to a fifth embodiment of this invention;

FIG. 10 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus illustrated in FIG. 9;

FIG. 11 shows a block diagram of an abnormal behavior detectionapparatus according to a sixth embodiment of this invention;

FIG. 12 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus illustrated in FIG. 11;

FIG. 13 shows a block diagram of an abnormal behavior detectionapparatus according to a seventh embodiment of this invention;

FIG. 14 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus illustrated in FIG. 13;

FIG. 15 shows a block diagram of a probabilistic distribution estimationapparatus according to an eighth embodiment of this invention;

FIG. 16 shows a block diagram of a probabilistic distribution estimationapparatus according to a ninth embodiment of this invention;

FIG. 17 shows a block diagram of an abnormal behavior detectionapparatus according to a tenth embodiment of this invention;

FIG. 18 shows a block diagram of an abnormal behavior detectionapparatus according to an eleventh embodiment of this invention;

FIG. 19 shows a block diagram of an abnormal behavior detectionapparatus according to a twelfth embodiment of this invention;

FIG. 20 shows a block diagram of an abnormal behavior detectionapparatus according to a thirteenth embodiment of this invention;

FIG. 21 shows a block diagram of an abnormal behavior detectionapparatus according to a fourteenth embodiment of this invention;

FIG. 22 is a view for use in describing an example of this invention;and

FIG. 23 is a view for use in describing another example of thisinvention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring to FIG. 1, the description will proceed to a probabilisticdistribution estimation apparatus 2 according to a first embodiment ofthis invention. The probabilistic distribution estimation apparatus 2 isconnected to an input unit 1. The probabilistic distribution estimationapparatus 2 comprises a certainty calculation unit 21, a parameterstorage unit 22, a parameter renewal unit 23, and a parameter outputunit 24.

The probabilistic distribution estimation apparatus 2 is for respondingto, as input data, a string of vector data to estimate, using astochastic model having hidden variables, a probabilistic distributionoccurred in each data by successively reading the string of vector data.

The parameter storage unit 22 is a unit for storing all of parameters ofthe stochastic model having the hidden variables. The certaintycalculation unit 21 is a unit for calculating a certainty where theinput data occurs. Specifically, the certainty calculation unit 21calculates, in response to the input data, the certainty where the inputdata occurs using the stochastic model by reading the parameters of thestochastic model from the parameter storage unit 22. The parameterrenewal unit 23 renews the parameters in accordance with a parameterrenewal rule which will later be described. In other words, theparameter renewal unit 23 renews contents of the parameter storage unit22 in accordance with new read data with past data forgotten by readingthe certainty from the certainty calculation unit 21 and by reading eachparameter of the stochastic model from the parameter storage unit 22.The parameter output unit 24 outputs the parameters stored in theparameter storage unit 22. That is, the parameter output unit 24 outputsseveral parameters of the stochastic model stored in the parameterstorage unit 22.

Referring to FIG. 2 in addition to FIG. 1, description will be made asregards operation of the probabilistic distribution estimation apparatus2.

Prior to data reading, a value of each parameter stored in the parameterstorage unit 22 is initialized at a step S10. Subsequently, theprobabilistic distribution estimation apparatus 2 carries out operationevery when new data y is supplied thereto in the manner which willpresently be described. The new data y is delivered to the certaintycalculation unit 21 and the parameter renewal unit 23 to be storedtherein (step S11).

The certainty calculation unit 21 reads a value of a current parameterfrom the parameter storage unit 22, calculates a certainty forgenerating the new data y using the value of the current parameter, andsends the certainty to the parameter renewal unit 23 (step S12).

The parameter renewal unit 23 reads the value of the current parameterfrom the parameter storage unit 22, reads the new data y, and rewritesthe value of the parameters stored in the parameter storage unit 22(step S13).

The parameter renewal rule is a rule obtained by improving an EMalgorithm for use in a normal parameter estimation so as to able toadaptively learn on on-line and at a high-speed. An example of the EMalgorithm is an article contributed by Dempster et al. to “Journal ofthe Royal Statistical Society,” Series B, Vol. 39, No. 1, 1977, pages1-38, under the title of “Maximum likelihood from incomplete data viathe EM algorithm.” The EM algorithm is an algorithm which maximizes aconditional expected value of a logarithm scale using all data everyrepetition. On maximizing the conditional expected value of thelogarithm scale, a parameter is calculated using a conditional expectedvalue of a sufficient statistical amount. On the other hand, theparameter renewal rule becomes the algorithm for calculating theconditional expected value of the sufficient statistical amount weightedwith an oblivion coefficient r with data serially read. Morespecifically, it is assumed that data y^(j)=(y₁, . . . , y_(Tj)) is aj-th read data. A conditional expected value of a weighted sufficientstatistical amount for all data is obtained by weighting the conditionalexpected value of the sufficient statistical amount of a current datay^(j) with r, by weighting the conditional expected value of thesufficient statistical amount of past data y¹, . . . , y^(j−1) with(1−r), and by summing those. That is, this realizes estimation whereprevious data is oblivious for past first through (j-1)-th data. It willbe assumed that the oblivion coefficient r is a constant between zeroand one, both exclusive, independent of data, namely, 0<r<1. In thisevent, when the oblivion coefficient r has a large value, estimation forbeing oblivious past is carried out. If r=1/j, it is possible to learnwith all of the first through j-th data equally weighted. In addition,it is possible to determine the oblivion coefficient r dependent fromdata so that, for example, data is more lightly weighted when certaintyof the current data is small. By using the parameter renewal rule whichis described above, it is possible to adaptively learn data whosetendency changes as time passes.

Description will be made in more detailed. At first, description will bemade as regards learning of behavior data represented by discrete vectordata.

It will be assumed that discrete vector values of data y=(y₁, . . . ,y_(T)) has a probabilistic distribution which occurs, for example,according to an expression (1) indicating a finite mixed distribution ofan n-dimensional hidden Markov model. $\begin{matrix}{{P\left( y \middle| \theta \right)} = {\sum\limits_{k = 1}^{K}{\pi_{k}{P_{k}\left( y \middle| \theta_{k} \right)}}}} & (1)\end{matrix}$where K represents an integer indicative of an overlapped number of thefinite mixed distribution, π_(k)(k=1, . . . , K) represents occurrenceprobability of each hidden Markov model that is satisfied with anexpression (2): $\begin{matrix}{{\prod_{k}{\bullet\quad 0\quad{and}\quad{\sum\limits_{k = 1}^{K}\pi_{k}}}} = 1} & (2)\end{matrix}$The probabilistic distribution of the data y is represented by anexpression (3) indicating K n-dimensional hidden Markov models of thefinite mixed distribution. $\begin{matrix}{{P_{k}\left( y \middle| \theta_{k} \right)} = {\sum\limits_{({x_{1},\ldots\quad,x_{T}})}\left( {{\gamma\left( {x_{1},\ldots\quad,x_{n}} \right)}{\prod\limits_{t = {n + 1}}^{T}{{a\left( {\left. x_{t} \middle| x_{t - 1} \right.,\ldots\quad,x_{t - n}} \right)}{\prod\limits_{t = 1}^{T}{b\left( y_{t} \middle| x_{t} \right)}}}}} \right)}} & (3)\end{matrix}$where x₁, . . . , x_(T) represent hidden variable series, γ representsan initial probabilistic vector, and a and b represent probabilistictransition matrix. $\sum\limits_{({x_{1},\ldots\quad,x_{T}})}$means a summation of all combinations of the hidden variable series x₁,. . . , x_(T).

When the hidden variable series x₁, . . . , x_(T) are equal to y₁, . . ., y_(T), namely, x₁=y₁, . . . , x_(T)=y_(T), the hidden Markov modelbecomes a Markov model. When the integer K is equal to one, namely, K=1,and when the number of a state where a hidden variable can take is equalto one, the finite mixed distribution of the hidden Markov model becomesa naive Bayes model.

It will be assumed that it is practically difficult to calculate theexpression (3) because the number of the state where the hidden variablecan take and a value of T are large. In this event, the expression (3)is approximated by probability of transition series in an optimum statethat is calculated by using a Viterbi algorithm by Viterbi. Such aViterbi algorithm is described in IEEE Transactions on InformationTheory, 13, 1967, pages 260-267 under the title of “Error bounds forconvolutional codes and an asymptotically optimum decoding algorithm.”It will be assumed that the occurrence probability π_(k) of a k-thhidden Markov model, an occurrence probability of each output symbol inthe initial probabilistic vector γ, and probability of each statetransition in the probabilistic transition matrix are represented by aparameter vector θ_(k)(k=1, . . . , K) and θ=(θ1, . . . , θ_(k)).

The parameter storage unit 22 stores c_(k), γ₁, a₁, and b₁ for theabove-mentioned parameter θ and each k that are calculated by aparameter renewal rule which will be later be described. It is assumedthat the number K of the hidden Markov models, the oblivion coefficientr representative of an oblivion rate of the past data (0<r<1; the pastdata is quickly oblivious when the oblivion coefficient r is large), anda parameter v are preliminarily given and all of these parameters areinitialized before data is read.

The certainty calculation unit 21 calculates certainty as occurrenceprobability in accordance with the expressions (1) and (3).

The parameter renewal unit 23 successively calculates parameters foreach k=1, . . . , K as represented by following expressions (4) through(11): $\begin{matrix}{\quad{c_{k} = {{\left( {1 - {\upsilon\quad\tau}} \right)\frac{\pi_{k}{P_{k}\left( y \middle| \theta_{k} \right)}}{\sum_{k^{\prime}}{\pi_{k^{\prime}}{P_{k^{\prime}}\left( y \middle| \theta_{k^{\prime}} \right)}}}} + \frac{\upsilon\quad\tau}{K}}}} & (4) \\{\quad{\pi_{k}:={{\left( {1 - r} \right)\pi_{k}} + {rc}_{k}}}} & (5) \\{\quad{{\gamma_{1}\left( {s_{1},\ldots\quad,s_{n}} \right)}:={{\left( {1 - r} \right){\gamma_{1}\left( {s_{1},\ldots\quad,s_{n}} \right)}} + {{rc}_{k}{\sum\limits_{{Sn} + 1}T_{{s\quad 1},\ldots\quad,{{sn} + 1},1}}}}}} & (6) \\{\quad{{\gamma\left( {s_{1},\ldots\quad,s_{n}} \right)} = {{\gamma_{1}\left( {s_{1},\ldots\quad,s_{n}} \right)}/{\sum\limits_{({{s^{\prime}1},\ldots\quad,s_{n}^{\prime}})}{\gamma_{1}\left( {s_{1}^{\prime},\ldots\quad,s_{n}^{\prime}} \right)}}}}} & (7) \\{{a_{1}\left( {s_{1},\ldots\quad,s_{n},s_{n + 1}} \right)}:={{\left( {1 - r} \right){a_{1}\left( {s_{1},\ldots\quad,s_{n},s_{n + 1}} \right)}} + {{rc}_{k}{\sum\limits_{t = 1}^{T - n}\tau_{{s\quad 1},\ldots\quad,{{sn} + 1},t}}}}} & (8) \\{{a\left( {\left. s_{n + 1} \middle| s_{n} \right.,\ldots\quad,s_{1}} \right)}{{a_{1}\left( {s_{1},\ldots\quad,s_{n},s_{n + 1}} \right)}/{\sum\limits_{{sn} + 1}{a_{1}\left( {s_{1},\ldots\quad,s_{n},s_{n + 1}} \right)}}}} & (9) \\{\quad{{b_{1}\left( s \middle| u \right)}:={{\left( {1 - r} \right){b_{1}\left( {s,u} \right)}} + {{rc}_{k}{\sum\limits_{t = {{1\bigwedge{yt}} = u}}^{T}\tau_{s,t}^{\prime}}}}}} & (10) \\{\quad{{b\left( u \middle| s \right)} = {{b_{1}\left( {s,u} \right)}/{\sum\limits_{u^{\prime}}{b_{1}\left( {s,u^{\prime}} \right)}}}}} & (11)\end{matrix}$

The expression (5) is calculation for renewing the conditional expectedvalue of the weighted sufficient statistical amount having thecoefficient π_(k) of the finite mixed distribution. The parameters γ₁,a₁, and b₁ of the expressions (6), (8), and (10) are calculations forrenewing the conditional expected values of the weighted sufficientstatistical amounts for the parameters γ, a, and b of the n-dimensionalhidden Marcov model, respectively. In all of the expressions (5), (6),(8), and (10), calculation is carried out by weighting the conditionalexpected value of the sufficient statistical amount of current data ywith r, by weighting the conditional expected values of the sufficientstatistical amounts of past data with (1−r), and by summing thesevalues. The coefficient π_(k) of the finite mixed distribution is theconditional expected value of the weighted sufficient statistical amountthat is calculated in accordance with the expression (5). The parametersγ, a, and b of the n-dimensional hidden Marcov model are calculated bynormalizing γ₁, a₁, and b₁ as expressed by the expressions (7), (9), and(11).

In the expressions (10) and (11), u represents each symbol of the inputdata. In the expressions (6) to (11), s, s′, and s₁, . . . , s_(n+1)represent hidden variable symbols, τ represents a posteriori probabilityof the hidden variable from a time instant (t−n+1) to a time instant(t+1) when the input data is given, and τ′ represents a posterioriprobability of the hidden variable at a time instant t when the inputdata is given. The posteriori probabilities are calculated by using aBaum-Welch algorithm by Baum et al. that is well used in a parameterestimation of the hidden Marcov model. The Baum-Welch algorithm isdescribed in The Annals of Mathematical Statistics, 41(1), 1970, pages164-171 under the title of “A maximization technique occurring in thestatistical analysis of probabilistic functions of Markov chains.” Inaddition, a symbol of “:=” means to substitute a calculated result of aright-hand into a left-hand and a symbol of “Λy_(t)=u” means to sum onlywhen a symbol of the input data at a t-th time instant is equal to u.

In the above, description is made as regards the probabilisticdistribution estimation apparatus for learning the behavior datarepresented by discrete vector data with the finite mixed distributionof the n-dimensional hidden Marcov model exemplified a stochastic modelhaving the hidden variables.

In the manner which is described above, the finite mixed distribution ofthe hidden Marcov model includes the Marcov model, the naive Bayesmodel, and a finite mixed distribution of them. Besides the finite mixeddistribution of the hidden Marcov model, the stochastic model having thehidden variables representative of the discrete vector data may be thehidden Marcov model having a continuous time distribution, afinite-state probabilistic automaton, a Bayesian network, a neuralnetwork, or the like.

It will be assumed that the hidden variable x_(t) at a time instant t isrepresented by x_(t)=h_(x)(x₁, . . . , x_(t−1)) using a linear or anon-linear function h_(x). It will be assumed that an observed timesequence y_(t) is represented by y_(t)=h_(y)(x₁, . . . , x_(t)) using alinear or a non-linear function h_(y). In this event, there is a statespace model representing all of discrete vector data represented byh_(x) and h_(y). It is possible to apply the parameter renewal rule asregards a stochastic model having all of hidden variables which arecapable of analytically calculating the conditional expected value ofthe sufficient statistical values.

Now, description will proceed to learning of behavior data representedby continuous vector data.

It will be assumed that data y=(y₁, . . . , y_(T)) having continuousvector values occurs in accordance with a probabilistic distribution,for example, represented by the expression (1) which represents thefinite mixed distribution of a one-dimensional hidden Marcov modelhaving a continuous time distribution and an autoregressive modelcorresponding to each state, where y₁, . . . , y_(T) representmulti-dimensional continuous vector values, respectively. Similar to acase of discrete vector data, K represents an integer indicative of aoverlapped number of the finite mixed distribution and πk (k=1, . . . ,K) represents an occurrence probability of each one-dimensional hiddenMarcov model that satisfies the expression (2). The probabilisticdistribution is represented by expressions (12) through (14) whichrepresent the one-dimensional hidden Marcov model having K continuoustime distributions of the finite mixed distribution and theautoregressive model corresponding to each state. $\begin{matrix}{{P_{k}\left( y \middle| \theta_{k} \right)} = {\sum\limits_{({{x\quad 1},\ldots\quad,{xT}^{\prime}})}{\sum\limits_{({{d\quad 1},\ldots\quad,{dT}^{\prime}})}{{\gamma\left( x_{1} \right)}{\prod\limits_{t = 2}^{T^{\prime}}{{a\left( x_{t} \middle| x_{t - 1} \right)}{\prod\limits_{t = 1}^{T^{\prime}}{P\left( {d_{t},\left. {y(t)} \middle| x_{t} \right.} \right)}}}}}}}} & (12) \\{{{P\left( {d_{t},\left. {y(t)} \middle| x_{t} \right.} \right)} = {{{P\left( {\left. d_{t} \middle| x_{t} \right. = s} \right)}{\prod\limits_{t = 0}^{{dt} - 1}{{P\left( {\left. y_{{\omega\quad t} + t} \middle| y_{{\omega\quad t} + t - L}^{{\omega\quad t} - t - 1} \right.,\theta_{s}} \right)}y_{{\omega\quad t} + y - L}^{{\omega\quad t} + t - 1}}}}:=y_{{wt} - t - 1}}},\ldots\quad,y_{{\omega\quad t} + t - L}} & (13) \\{\quad{{P\left( {\left. d_{t} \middle| x_{t} \right. = s} \right)} = {{\mathbb{e}}^{{- \lambda}\quad s}{\lambda_{s}^{dt}/{d_{t}!}}}}} & (14)\end{matrix}$where x₁, . . . , x_(T) represent hidden variable sequences, γrepresents an initial probabilistic vector, and a and b representprobabilistic transition matrixes. It is assumed that successive hiddenvariables x_(T), x_(T+1) indicate different states and T′≦T.P(d_(t)|x_(t)=s) in the expression (13) is a probability of thecontinuous time distribution when the hidden variable x_(T) is put intothe state s. The continuous time distribution may be, for instance, aPoisson distribution, a geometrical distribution, an exponentialdistribution, a gamma distribution, or the like. The hidden Marcov modelhaving the continuous time distribution has inclusion relation to anormal hidden Marcov model. When the continuous time distribution is thegeometrical distribution, the hidden Marcov mode having the continuoustime distribution is the normal Marcov model. Now, description will beexemplified with a case of the Poisson distribution expressed by theexpression (14).

An expression (15) represents a formula of an L-dimensionalautoregressive model. $\begin{matrix}{{P\left( {\left. y_{{\omega\quad t} + t} \middle| y_{{\omega\quad t} + t - L}^{{\omega\quad t} + t - {\mathbb{i}}} \right.,\theta_{s}} \right)} = {\frac{1}{\left( {2\quad\pi} \right)^{L/2}{\sum_{s}}^{1/2}} \times \exp\quad\begin{Bmatrix}{{- \frac{1}{2}}\left( {y_{{\omega\quad t} + t} - \mu_{s} - \begin{pmatrix}{{\beta_{s,1}\left( {y_{{w\quad t} + t - 1} - \mu_{s}} \right)} + \ldots +} \\{\beta_{s,L}\left( {y_{{\omega\quad t} + t - L} - \mu_{s}} \right)}\end{pmatrix}} \right)^{T} \times} \\\left. {{\sum_{s}^{- 1}y_{{\omega\quad t} + t}} - \mu_{s} - \begin{pmatrix}{{\beta_{s,1}\left( {y_{{\omega\quad t} + t - 1} - \mu_{s}} \right)} + \ldots +} \\{\beta_{s,L}\left( {y_{{\omega\quad t} + t - L} - \mu_{s}} \right)}\end{pmatrix}} \right)\end{Bmatrix}}} & (15)\end{matrix}$

An average μ_(s) of the autoregressive model corresponding to a statewhere each hidden variable can take, coefficients β₁, . . . , β_(L), anda variance covariance matrix Σ_(s) are represented by a parameter vectorθ_(s). An occurrence probability π_(k) of a k-th hidden Marcov model, anoccurrence probability of each output symbol in the initialprobabilistic vector γ, each state transition probability in theprobabilistic transition matrix a and b, an parameter λ_(s) of thecontinuous time distribution corresponding to each state of the hiddenvariable, and the above-mentioned parameter vector θ_(s) are representedby a parameter vector θ_(k)(k=1, . . . , K) and θ=(θ₁, . . . , θ_(k)).

It will be assumed that it is practically difficult to calculate theexpression (12) because the number of state in which the hidden variablecan take and the value of T are large in the similar manner as a case ofan example of the discrete vector data. In this event, the expression(12) is approximated by a probability of the state transition sequenceof the optimum state which is calculated by using an algorithm where theViterbi algorithm by Viterbi is expanded to a case having the continuoustime distribution. Such an algorithm is described in a book “Speechrecognition by a Stochastic model” edited by the institute ofelectronics, information and communication engineers, 1988, pages 74-78.

The parameter storage unit 22 stores parameters c_(k), γ₁, a₁, b₁,d_(s), λ_(s,1), μ_(s,1), C_(s,1,1), and Σ_(s,1) for the above-mentionedparameter θ and each k that are calculated in accordance with aparameter renewal rule which will later be described. In the similarmanner as a case of an example of the discrete vector data, it will beassumed that the number K of the hidden Marcov models, the oblivioncoefficient r indicative of the oblivion rate of the past data (0<r<1;the past data is quickly oblivious when r is large), and a parameter vare preliminarily given and all of the parameters are initialized beforedate is read.

The certainty calculation unit 21 calculates certainty in accordancewith the expressions (1), (12) through (15). The parameter renewal unit23 successively calculates the parameters for each k=1, . . . , K inaccordance with the expressions (4) and (5) and following expressions(16) through (29): $\begin{matrix}{\quad{{\gamma_{1}(s)}:={{\left( {1 - r} \right){\gamma_{1}(s)}} + {{rc}_{k}\tau_{s,1}^{\prime}}}}} & (16) \\{\quad{{\gamma(s)} = {{\gamma_{1}(s)}/{\sum\limits_{s^{''}}{\gamma_{1}\left( s^{''} \right)}}}}} & (17) \\{\quad{{a_{1}\left( {s,s^{\prime}} \right)}:={{\left( {1 - r} \right){a_{1}\left( {s,s^{\prime}} \right)}} + {{rc}_{k}{\sum\limits_{t = 1}^{T - 1}{\sum\limits_{d}\tau_{s,s^{\prime},d,t}}}}}}} & (18) \\{\quad{{a\left( s^{\prime} \middle| s \right)} = {{a_{1}\left( {s,s^{\prime}} \right)}/{\sum\limits_{s^{''}}{a_{1}\left( {s,s^{''}} \right)}}}}} & (19) \\{\quad{d_{s}:={{\left( {1 - r} \right)d_{s}} + {{rc}_{k}{\sum\limits_{t}{\sum\limits_{d}{\tau_{s,d,t}^{''}d}}}}}}} & (20) \\{\quad{\lambda_{s,1}:={{\left( {1 - r} \right)\lambda_{s,1}} + {{rc}_{k}{\sum\limits_{t}{\sum\limits_{d}\tau_{s,d,t}^{''}}}}}}} & (21) \\{\quad{\lambda_{s} = {d_{s}/\lambda_{s,1}}}} & (22) \\{\quad{\mu_{s,1}:={{\left( {1 - r} \right)\mu_{s,1}} + {{rc}_{k}{\sum\limits_{t}{\sum\limits_{d}{\tau_{s,d,t}^{''}{\sum\limits_{d^{\prime} = 0}^{d - 1}y_{t + d^{\prime}}}}}}}}}} & (23) \\{\quad{\mu_{s} = {\mu_{s,1}/d_{s}}}} & (24) \\{C_{s,l,1}:={{\left( {1 - r} \right)C_{s,l,1}} + {{rc}_{k}{\sum\limits_{t}{\sum\limits_{d}{\tau_{s,d,t}^{''}{\sum\limits_{d^{\prime} = 0}^{d - 1}{\left( {y_{t + d^{\prime}} - \mu_{s}} \right)\left( {y_{t + d^{\prime} - l} - \mu_{s}} \right)^{T}}}}}}}}} & (25) \\{\quad{C_{s,l} = {C_{s,l,1}/d_{s}}}} & (26) \\{\quad{C_{s,l} = {\sum\limits_{l^{\prime} = 1}^{L}{\beta_{s,l^{\prime}}C_{s,{l - l^{\prime}}}}}}} & (27) \\{\sum_{s,1}{= {\left( {1 - r} \right){\sum_{s,1}{{+ {rc}_{k}}{\sum\limits_{t}{\sum\limits_{d}{\tau_{s,d,t}^{''}{\sum\limits_{d^{\prime} = 0}^{d - 1}{\left( {y_{t + d^{\prime}} + {\hat{y}}_{t + d^{\prime}}} \right)\left( {y_{t + d^{\prime}} - {\hat{y}}_{t + d^{\prime}}} \right)^{T}}}}}}}}}}} & (28) \\{\quad{\sum_{s}{= {\sum_{s,1}{/d_{s}}}}}} & (29)\end{matrix}$

where T represents a posteriori probability where the state is put intoa state s from a time instant t to a time instant (t+d−1) and is putinto a state s′ at a time instant (t+d) when the input date is given, T″represents a posteriori probability where the state is put into thestate s from the time instant t to the time instant (t+d−1) when theinput data is given, and T′ represents a posteriori probability wherethe state is put into the state s from the time instant t. Theseposteriori probabilities T, T″, and T′ are calculated by using analgorithm where the Baum-Welch algorithm by Baum et al. is expanded to acase having the continuous time distribution. Such an algorithm isdescribed, for instance, in a book “Speech recognition by a Stochasticmodel” edited by the institute of electronics, information andcommunication engineers, 1988, pages 74-78. In the expressions (20) and(21), ds and λs,1 are the conditional expected values of the weightedsufficient statistical amounts of the Poisson distribution which is thecontinuous time distribution, respectively. μ_(s,1) in the expression(23), C_(s,1,1,) in the expression (25), and Σ_(s,1) are the conditionalexpected values of the weighted sufficient statistical amounts of theautoregressive model, respectively. In particular, C_(s,1,1) (1=1, . . ., L) in the expression (25) calculates the conditional expected value ofthe weighted sufficient statistical amount of an auto-correlationcoefficient in the L-dimensional autoregerssive model. In addition,coefficient matrixes β₁, . . . , β_(L) of the autoregressive model areobtained by solving an L-dimensional simultaneous equations of theexpression (27), where C_(s,−1)=C_(s,1).

Predicted values of the respective y_(t+d′) in the expression (28) iscalculated in accordance with a following expression (30) by using β₁, .. . , β_(L) obtained by the expression (27).ŷ _(t+d′)=μ_(s)+β_(s,1)(y _(t+d″−1)−μ_(s))+ . . . +β_(s,L)(y_(t+d′−L)−μ_(s))  (30)

In the above, description is exemplified, as the stochastic model havingthe hidden variable, with the finite mixed distribution of theone-dimensional hidden Marcov model having the continuous timedistribution and the autoregressive mode corresponding to each state inthe probabilistic distribution estimation apparatus for learning thebehavior data represented by the continuous vector data. This example iseasily expanded to the finite mixed distribution of an n-dimensionalhidden Marcov model having the continuous time distribution and theautoregressive model corresponding to each state. Alternatively, themodel corresponding to each state may be a regressive model, amoving-average model, an autoregerssive moving-average model, or anormal distribution. In addition, the model corresponding to each statemay be a finite mixed distribution of the autoregressive model or apolynomial regressive model, or a factor analysis model.

It will be assumed that the hidden variable x_(t) at a time instant t isrepresented by x_(t)=h_(x)(x₁, . . . , x_(t−1)) by using a linear or anonlinear function h_(x). In addition, it will be assumed that anobserved time sequence y_(t) is represented by y_(t)=h_(y)(x₁, . . . ,x_(t)) by using a linear or a nonlinear function h_(y). In this event,there is a state space model indicative of all of the continuous vectordata represented by h_(x) and h_(y). It is possible to apply theabove-mentioned parameter renewal rule as regards the stochastic modelhaving all of the hidden variables which can analytically calculate theconditional expected value of the sufficient statistical amount.

According to the first embodiment of this invention, it is possible toestimate, by using the stochastic model, the probabilistic distributionin which each data generates at robust for noises at a high speed byapplying an on-line algorithm and by adaptively learning a lot ofbehavior data by using an oblivion-type algorithm.

Second Embodiment

Referring to FIG. 3, the description will proceed to a probabilisticdistribution estimation apparatus 4 according to a second embodiment ofthis invention. The probabilistic distribution estimation apparatus 4 issimilar in structure and operation to the probabilistic distributionestimation apparatus 2 illustrated in FIG. 1 except that theprobabilistic distribution estimation apparatus 4 further comprises asession unit 41. Inasmuch as operations of the certainty calculationunit 21, the parameter storage unit 22, the parameter renewal unit 23,and the parameter output unit 24 are similar to those of the units 21-24in the probabilistic distribution estimation apparatus 2, the operationsthereof are omitted.

When date obtained from the input unit 1 has no vector format indicativeof behavior, the session unit 41 carries out session for converting thedata into vector data. In other words, the session unit 41 processes orconverts the input data into the string of vector data when the inputdata has no structure of vector data.

Input data in a case where the probabilistic distribution estimationapparatus does not comprises the session unit 41 and date after carryingout session in a case where the probabilistic distribution estimationapparatus comprises the session unit 41 are described as input datahereinunder.

FIG. 4 is a flow chart for use in describing schematic operation of theprobabilistic distribution estimation apparatus 4 illustrated in FIG. 3.At session of a step S22, the session unit 41 carries out session forconverting the input data into vector data when the input data has novector format indicative of behavior. Inasmuch as operations in stepsS20, S21, S23 to S25 are similar to those in the steps S10 to S14illustrated in FIG. 2, description of the operations thereof is omitted.

According to the second embodiment of this invention, it is possible toestimate a probabilistic distribution in which each data generates byadaptively learning a large amount of behavior data at robust for noisesand at a high speed although the data has no vector format indicative ofbe behavior.

Third Embodiment

To express the stochastic model having the above-mentioned hiddenvariable is sufficient to appoint values of the parameters calculated bythe probabilistic distribution estimation apparatus 2 or theprobabilistic distribution estimation apparatus 4. Accordingly, anabnormal behavior detection apparatus receives the values of theparameters from the parameter output unit 24 of the above-mentionedprobabilistic distribution estimation apparatus 2 or the above-mentionedprobabilistic distribution estimation apparatus 4 to calculate anabnormal behavior-like of the input data using the values of theparameters.

FIG. 5 is a block diagram showing an abnormal behavior detectionapparatus according to a third embodiment of this invention. Theabnormal behavior detection apparatus comprises the input unit 1 forinputting data, the output unit 3 for outputting a state estimatedscore, either the probabilistic distribution estimation apparatus 2illustrated in FIG. 1 or the probabilistic distribution estimationapparatus 4 illustrated in FIG. 3, and a state estimation unit 5 forcalculating a certainty where the input data has a state correspondingto each hidden variable. In other words, the state estimation unit 5uses the parameters of the probabilistic distribution estimated by theprobabilistic distribution estimation apparatus 2 or 4 to produce, as ascore, the certainty where the new read data has a state correspondingto each hidden variable of the stochastic model.

FIG. 6 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus according to the third embodiment of thisinvention. In the abnormal behavior detection apparatus according to thethird embodiment of this invention, the input unit 1 inputs the data(step S31), the probabilistic distribution estimation apparatus 2 or 4carries out renewal of the parameters (step S32), the state estimationunit 5 calculates the above-mentioned state estimated score using theobtained parameters (step S33), and the output unit 3 outputs thecalculated state estimated score (step S34).

It will be assumed that the stochastic model having the hidden variablesis represented by the finite mixed distribution having any stochasticmodel P_(k) in the manner which is described by the expression (1). Thestate estimation unit 5 calculates and outputs, as the state estimatedscore C_(k), a posteriori probability indicative of a probabilityhappening from the stochastic model P_(k) for each k in accordance witha following expression (31) by using the values of the parametersreceived from the parameter output unit 24 of probabilistic distributionestimation apparatus 2 or 4: $\begin{matrix}{c_{k} = \frac{\pi_{k}{P_{k}\left( y^{j} \middle| \theta_{k} \right)}}{\sum_{k^{\prime}}{\pi_{k^{\prime}}{P_{k^{\prime}}\left( y^{j} \middle| \theta_{k^{\prime}} \right)}}}} & (31)\end{matrix}$

The state estimation unit 5 further calculates and outputs certaintywhere each hidden variable x_(t) takes the corresponding state forexample when the n-dimensional hidden Marcov mode of the expression (3)is used as the stochastic model P_(k). The state estimation unit 5 maycalculate and output certainty where the hidden variables take thecorresponding states as regards all of the hidden variables of thestochastic model having the hidden variables.

According to the third embodiment of this invention, inasmuch as theabnormal behavior detection apparatus carries out an adaptiveprobabilistic distribution estimation using the oblivion-type algorithmwith the behavior data serially read and calculates, as the stateestimated score, the certainty where the input data has the statecorresponding to each hidden variable by using the estimatedprobabilistic distribution, it is possible to carry out detection ofabnormal behavior data by the abnormal behavior detection apparatususing the probabilistic distribution estimation apparatus for estimatingthe probabilistic distribution in which each data occurs by adaptivelylearning a large amount of behavior data at robust for noises and at ahigh speed.

Fourth Embodiment

Referring to FIG. 7, the description will proceed to an abnormalbehavior detection apparatus according to a fourth embodiment of thisinvention. The abnormal behavior detection apparatus according to thefourth embodiment comprises the input unit 1 for inputting data, theoutput unit 3 for outputting an abnormal behavior degree, either theprobabilistic distribution estimation apparatus 2 illustrated in FIG. 1or the probabilistic distribution estimation apparatus 4 illustrated inFIG. 3, and an abnormality detection unit 6 for calculating an abnormalbehavior degree of the input data. In other words, the abnormalitydetection unit 6 calculates an information amount of the new read databy using the parameters of the probabilistic distribution estimated bythe probabilistic estimation apparatus to produce the abnormal behaviordegree of the new read data.

The abnormality detection unit 6 comprises an abnormal behavior degreecalculation unit 61 which calculates and outputs an information amountof data as the abnormal behavior degree using the values of theparameters received from the parameter output unit 24 of theprobabilistic distribution estimation apparatus 2 or 4. Morespecifically, the abnormal behavior degree calculation unit 61calculates, using parameters θ^((j-1)) of the probabilistic distributionestimated from first through (j-1)-th data on current inputted datay^(j) having a length of T_(j), a score indicative of the abnormalbehavior degree in accordance with a following expression (32) or (33):$\begin{matrix}{{{Score}\quad 1\left( y^{j} \right)} = {{- \frac{1}{f\left( y^{j} \right)}}\log\quad{P\left( y^{j} \middle| \theta^{({j - 1})} \right)}}} & (32) \\{{{Score}\quad 1\left( y^{j} \right)} = {{{- \frac{1}{f\left( y^{j} \right)}}\log\quad{P\left( y^{j} \middle| \theta^{({j - 1})} \right)}} - {{Compress}\quad\left( y^{j} \right)}}} & (33)\end{matrix}$

The expression (32) or (33) means that the input data y^(j) is theabnormal behavior data out of the whole of patterns when Score1(y^(j))has a large value. A first term of the expressions (32) and (33)corresponds to a compression rate when the input data y^(j) iscompressed using the stochastic model P. “Compress” in the expression(33) indicates a compression rate when the input data y^(j) iscompressed using a universal code such as the Lemple-Ziv code.Accordingly, a second term of the expression (33) has an effect so as togive high score to the abnormal behavior data having a regular patternor a peculiar pattern. Estimation parameters used in the expression (32)or (33) are directly generalized to θ(j-w) or the like, where Wrepresents a positive integer. f(y^(j)) is a function indicative of alength of the input data y^(j). When the input data y^(j) is discretevector data, for instance, f(y^(j))=T_(j) and a base of a logarithmfunction in the expressions (32) and (33) may be a total number ofoutput symbols. When the input data y^(j) is continuous vector data, forinstance, g(y_(t)) is a bit number required in a case where y_(t) isrepresented by binary number in a computer and f(y^(j))=Σ_(t)g(y_(t)).In addition, a base of the logarithm function of the expressions (32)and (33) is two.

FIG. 8 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus according to the fourth embodiment of thisinvention. In the abnormal behavior detection apparatus according to thefourth embodiment, the input unit 1 inputs data (step S41), theprobabilistic distribution estimation apparatus 2 or 4 carries outrenewal of the parameters (step S42), the abnormal behavior degreecalculation unit 61 of the abnormality detection unit 6 calculates theabove-mentioned abnormal behavior degree using the obtained parameters(step S43), and the output unit 3 outputs the calculated abnormalbehavior degree (step S44).

According to the fourth embodiment of this invention, inasmuch as theabnormal behavior detection apparatus carries out the adaptiveprobabilistic distribution estimation using the oblivion-type algorithmwith the behavior data serially read and calculates the abnormalbehavior degree using the estimated probabilistic distribution asinformation amount for the probabilistic distribution of the data, it ispossible to carry out detection of abnormal behavior data by theabnormal behavior detection apparatus using the probabilisticdistribution estimation apparatus for estimating the probabilisticdistribution in which each data generates by adaptively learning a largeamount of behavior data at robust for noises and at a high speed.

Fifth Embodiment

Referring to FIG. 9, the description will proceed to an abnormalbehavior detection apparatus according to a fifth embodiment of thisinvention. The abnormal behavior detection apparatus according to thefifth embodiment of this invention comprises the input unit 1 forinputting data, the output unit 3 for outputting a variation degree of abehavior model, either the probabilistic distribution estimationapparatus 2 illustrated in FIG. 1 or the probabilistic distributionestimation apparatus 4 illustrated in FIG. 3, and an abnormalitydetection unit 7 for calculating an abnormal behavior degree of theinput data to calculate the variation degree of the behavior model usingthe abnormal behavior degree.

The abnormality detection unit 7 comprises the abnormal behavior degreecalculation unit 61 and a behavior model variation degree calculationunit 71. By using the abnormal behavior degree calculated by theabnormal behavior degree calculation unit 61, the behavior modelvariation degree calculation unit 71 calculates and outputs an averageof the abnormal behavior degree as a score indicative of the variationdegree of the behavior model. In other words, the behavior modelvariation degree calculation unit 71 calculates, by using the parametersof the probabilistic distribution estimated by the probabilisticdistribution estimation apparatus 2 or 4, a variation degree of abehavior model as a time-average of the abnormal behavior degrees for apredetermined width by reading a plurality of new data. Morespecifically, it will be assumed that W is a predetermined timeinterval. The behavior model variation degree calculation unit 71calculates the score using current inputted data y^(j), (W−1) datay^(j−W+1), . . . , y^(j−1) inputted just before, and a parameterθ^((j−W)) of the probabilistic distribution estimated from firstthorough (j-W)-th data, for instance, in accordance with a followingexpression (34). The expression (34) means that yj−W+1, . . . , yjrepresent burst abnormal behavior data when the score has a large value.$\begin{matrix}{{{Score}\quad 2\left( y^{j} \right)} = {\frac{1}{W}{\sum\limits_{j^{\prime} = {j - W + 1}}^{j}\quad\begin{pmatrix}{{{- \frac{1}{f\left( y^{j^{\prime}} \right)}}\log\quad{P\left( y^{j^{\prime}} \middle| \theta^{({j - W})} \right)}} -} \\{{Comress}\left( y^{j^{\prime}} \right)}\end{pmatrix}}}} & (34)\end{matrix}$

FIG. 10 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus according to the fifth embodiment of thisinvention. In the abnormal behavior detection apparatus according to thefifth embodiment of this invention, the input unit 1 inputs data (stepS51), the probabilistic distribution estimation unit 2 or 4 carries outrenewal of the parameters (step S52), the abnormal behavior degreecalculation unit 61 calculates the abnormal behavior degree using theobtained parameters (step S53), the behavior model variation degreecalculation unit 71 calculates the above-mentioned variation degree ofthe behavior model using the abnormal behavior degree (step S54), theoutput unit 3 outputs the calculated variation degree of the behaviormodel (step S55).

According to the fifth embodiment of this invention, inasmuch as theabnormal behavior detection apparatus calculates, as the variationdegree of the behavior model, whether or not the abnormal behaviordegree indicative of an outlier value from the probabilisticdistribution obtained by adaptively learning past data is especiallylarge as an average within a constant interval to detect that theoutlier value occurs convergently, it is possible to detect a behavior'svariation which means burst abnormal behavior.

Sixth Embodiment

Referring to FIG. 11, the description will proceed to an abnormalbehavior detection apparatus according to a sixth embodiment of thisinvention. The abnormal behavior detection apparatus according to thesixth embodiment of this invention comprises the input unit 1 forinputting data, the output unit 3 for outputting a variation of aposteriori probability, either the probabilistic distribution estimationapparatus 2 illustrated in FIG. 1 or the probabilistic distributionestimation apparatus 4 illustrated in FIG. 3, a reference data inputunit 9 for inputting one or more reference data for use in a comparisontarget for the variation of the posteriori probability, a posterioriprobability calculation unit 8 for calculating a posteriori probabilityof the input data and a posteriori probability of the reference data,and a posteriori probability variation degree calculation unit 10 forcalculating the variation of the posteriori probability calculated bythe posteriori probability calculation unit 8. That is, the referencedata input unit 9 inputs data different from the input data.

The posteriori probability calculation unit 8 calculates, using theparameters of the probabilistic distribution estimated by theprobabilistic distribution estimation unit 2 or 4, the posterioriprobabilities indicative states corresponding to the hidden variables ofthe input data and the reference data inputted by the reference datainput unit 9. In other word, the posteriori probability calculation unit8 calculates a posteriori probability of the state corresponding to thehidden variables by using the parameters of the probabilisticdistribution estimated by the probabilistic distribution estimationapparatus 2 or 4.

The posteriori probability variation degree calculation unit 10calculates and outputs, as the variation degree of the posterioriprobability, a difference between two posteriori probabilitiescalculated by the above-mentioned posteriori probability calculationunit 8. In other words, the posteriori probability variation degreecalculation unit 10 calculates a variation of the posterioridistribution and outputs it by using the posteriori distribution of thestate corresponding to the hidden variables calculated by the posterioridistribution calculation unit 8 on the basis of the data read out of thereference data input unit 9 and by using the posteriori distribution ofthe state corresponding to the hidden variables calculated by theposteriori distribution calculation unit 8 on the basis of the new readdata.

Specifically, it will be assumed that the stochastic model having thehidden variables is represented, for instance, by the finite mixeddistribution of a stochastic model P_(k) as expressed by the expression(1). It will be assumed that the input data is represented by y^(j), adata set of the reference data is represented by Y, a positive integeris represented by W, and the estimated parameter is represented byθ^((j-W). The posteriori probability calculation unit 8 calculates P(k|Y,θ)^((j-W))) and P(k|Y,y^(j),θ^((j-W))) for each k. It is assumed that thereference data is a subset of past input data y¹, . . . , y^(j−1). Inthis event, the variation degree of the posteriori probability iscalculated by the posteriori probability variation degree calculationunit 10 in accordance with, for instance, a following expression (35) or(36). The expression (35) or (36) means that the input data y^(j) isabnormal behavior data different from a behavior pattern indicated bythe reference data when its value is large. $\begin{matrix}{{{Score}\quad 3\left( y^{j} \right)} = {\sum\limits_{k = 1}^{K}\quad{\begin{matrix}{{P\left( {\left. k \middle| Y \right.,y^{j},\theta^{({j - W})}} \right)} -} \\{P\left( {\left. k \middle| Y \right.,\theta^{({j - W})}} \right)}\end{matrix}}}} & (35) \\{{{Score}\quad 3\left( y^{j} \right)} = {\sum\limits_{k\quad = \quad 1}^{K}\quad\begin{pmatrix}{{P\left( {\left. k\quad \middle| \quad Y \right.,\quad y^{j},\quad\vartheta^{({j\quad - \quad W})}} \right)} -} \\{P\left( {\left. k\quad \middle| \quad Y \right.,\quad\theta^{({j\quad - \quad W})}} \right)}\end{pmatrix}}} & (36)\end{matrix}$

Alternatively, when the stochastic model P_(k) is, for instance, then-dimensional hidden Marcov model as expressed by the expression (3),the posteriori probability calculation unit 8 calculates the posterioriprobabilities where the respective hidden variables x_(t) take thecorresponding states for the input data and for data where the inputdata and the reference data are combined with each other, respectively.The posteriori probability variation degree calculation unit 10calculates and outputs a variation thereof. The posteriori probabilitycalculation unit 8 may calculate the posteriori probabilities where thehidden variables of the input data and the hidden variables of thereference data take the corresponding states for all of the hiddenvariables in the stochastic model having the hidden variables and theposteriori probability variation degree calculation unit 10 maycalculate and output a variation thereof.

FIG. 12 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus according to the sixth embodiment of thisinvention. In the abnormal behavior detection apparatus according to thesixth embodiment of this invention, the input unit 1 inputs data (stepS61), the probabilistic distribution estimation apparatus 2 or 4 carriesout renewal of the parameters (step S62), the reference data input data9 inputs the reference data for use in the comparison target of theposteriori probability (step S63), the posteriori probabilitycalculation unit 8 calculates the above-mentioned two posterioriprobabilities using the input data and the reference data (step S64),the posteriori probability variation degree calculation unit 10calculates the variation degree of the posteriori probability using thetwo posteriori probabilities (step S65), and the output unit 3 outputsthe calculated variation degree of the posteriori probability (stepS66).

According to the sixth embodiment of this invention, it is possible todetect, by using the variation degree of the posteriori probability, notonly the outlier value from whole of distribution but also the variationin the state corresponding the hidden variable for a program or a user.As a result, it is possible to detect the variation of behavior in eachindividual in a problem handling the behavior data in a condition wherea plurality of programs and data of a plurality of users are mixed.Simultaneously, it is possible to detect the abnormal behavior data inhigh precision in a case where the behavior data for each individual isfew. When the behavior data of the individual is few, by carrying outlearning using all data where a plurality of programs and the behaviordata of the users are combined with one another, it is possible toreliably carry out learning in comparison with a case of using onlysingle data by using data having a similar behavior pattern.Accordingly, it is possible to realize detection of the abnormalbehavior data at a high precision by using the estimated probabilisticdistribution and the posteriori probability variation degree calculationunit 10.

Seventh Embodiment

Referring to FIG. 13, the description will proceed to an abnormalbehavior detection apparatus according to a seventh embodiment of thisinvention. The abnormal behavior detection apparatus according to theseventh embodiment of this invention comprises the input unit 1 forinputting data, the output unit 3 for outputting a standard value ofinformation amount, a plurality of probabilistic distribution estimationapparatuses 2 or 4 illustrated in FIGS. 1 or 3 which carry outestimation of the parameters in parallel for the stochastic modelshaving different hidden variables in the states where the hiddenvariables can take, and an information amount standard calculation unit11.

By using the plurality of probabilistic distribution estimationapparatuses 2 or 4 illustrated in FIG. I or 3, the information amountstandard calculation unit 11 calculates standard of information amountusing calculated estimated parameters for the stochastic models havingdifferent hidden variables which are in number to the states where thehidden variables can take to produce, as an optimum value, the number ofthe states where the hidden variables can take when the standard valueof the information amount is least. In other words, the informationamount standard calculation unit 11 calculates, by using, in parallel,the plurality of probabilistic distribution estimation apparatuses 2 or4 for the stochastic models having different number of the states wherethe hidden variables can take, standard values of information amountsfrom the parameters of the probabilistic distributions estimated by therespective probabilistic distribution estimation apparatuses 2 or 4 andthe input data to produce, as the optimum value, the number of thestates where the hidden variables can take when the standard values ofthe information amount is the least.

Specifically, it will be assumed that the stochastic model having thehidden variables is represented by the finite mixed distribution of astochastic model P_(k), for instance, as expressed by the expression(1). It will be assumed that current input data is represented by y^(j)and W and Wo represent positive integers. In this event, the informationamount standard calculation unit 11 calculates a score for each K inaccordance with a following expression (37) or (38). The informationamount standard calculation unit 11 produces, as the number of optimumfinite mixed distributions, a value of K which is least one of Score4 inthe expression (37) or (38). The expression (37) or (38) means that thenumber of behavior patterns changes due to the input data y^(j) when thevalue of K which is least one of them changes. When the above-mentionedvalue of K becomes large, a new behavior pattern generates. When thevalue of K becomes small, the existing behavior pattern disappears. Forexample, it is possible to find a feature pattern of the abnormalbehavior data from generation of the new behavior pattern. In addition,it is possible to recognize a temporal change in a tendency of all datafrom generation and disappearance of the pattern. $\begin{matrix}{{{Score}\quad 4\left( y^{j} \right)} = {\sum\limits_{j^{\prime} = {j - W}}^{j}{{- \log}\quad{P\left( y^{j^{\prime}} \middle| \theta^{({j^{\prime} - 1})} \right)}}}} & (37) \\{{{Score}\quad 4\left( y^{j} \right)} = {\sum\limits_{j^{\prime} = {Wo}}^{j}{{- \log}\quad{P\left( y^{j^{\prime}} \middle| \theta^{({j^{\prime} - 1})} \right)}}}} & (38)\end{matrix}$

Alternatively, it will be assumed that the stochastic model P_(k) is,for instance, the n-dimensional hidden Marcov model expressed by theexpression (3). In this event, the plurality of probabilisticdistribution estimation apparatuses 2 or 4 illustrated in FIG. 1 or 3carry out, in parallel, parameter estimation when the number of thestates where the respective hidden variables x_(t) can take changes. Theinformation amount standard calculation unit 11 calculates standardvalues of the information amount for the finite mixed distributionshaving different n-dimensional hidden Marcov models which are equal innumber to the states to produce, as the optimum value, the number of thestates when the standard value of the information amount is least. Inaddition, it will be assumed that the stochastic model P_(k) is, forinstance, the one-dimensional hidden Marcov model having theautoregressive model corresponding to each state which has thecontinuous time distribution and the hidden variables. In this event,the plurality of probabilistic distribution estimation apparatuses 2 or4 illustrated in FIG. 1 or 3 carry out, in parallel, parameterestimation when the number of the states where the respective hiddenvariables x_(t) can take and the continuous time when the respectivehidden variables x_(t) take the corresponding states are changed. Theinformation amount standard calculation unit 11 calculates the standardvalues of the information amount for the finite mixed distributions ofthe one-dimensional hidden Marcov models which have the respectivecontinuous time distributions and the autoregressive modelscorresponding to the respective states which the hidden variables taketo produce, as the optimum value, the number and the continuous time ofthe state where the standard value of the information amount is least.

In all of hidden variables of the stochastic model having the hiddenvariables, the plurality of probabilistic distribution estimationapparatuses 2 or 4 illustrated in FIG. 1 or 3 may carry out, inparallel, the respective parameter estimations for the stochastic modelhaving different hidden variables which are in number to the stateswhich the hidden variables can take and the information amount standardcalculation unit 11 may calculate standard of the information amountusing the estimated parameters to produce, as the optimum value, thenumber of the states where the hidden variables can take when thestandard value of the information amount is least.

FIG. 14 is a flow chart for use in describing operation of the abnormalbehavior detection apparatus according to the seventh embodiment of thisinvention. In the abnormal behavior detection apparatus according to theseventh embodiment of this invention, the input unit 1 inputs data (stepS71), the plurality of probabilistic distribution estimation apparatuses2 or 4 carry out the parameter estimation on the respectiveprobabilistic distributions which are in number to states wheredifferent hidden variables can take (step S72), the information amountstandard calculation unit 11 calculates standard of the informationamount for the respective probabilistic distributions (step S73), andthe output unit 3 outputs the standard value of the information amount(step S74).

Eight Embodiment

Referring to FIG. 15, the description will proceed to a probabilisticdistribution estimation apparatus 2 according to an eight embodiment ofthis invention. The probabilistic distribution estimation apparatus 2according to the eighth embodiment of this invention is similar instructure and operation to the probabilistic distribution estimationapparatus 2 illustrated in FIG. 1 except that the illustratedprobabilistic distribution estimation apparatus 2 further comprises aprobabilistic distribution estimation program 100. Therefore, the samereference numerals are attached to similar components and the detaileddescription thereof is omitted.

The probabilistic distribution estimation program 100 is read orinstalled in the probabilistic distribution estimation apparatus 2implemented by a computer and controls operation of the probabilisticdistribution estimation apparatus 2 as the certainty calculation unit21, the parameter storage unit 22, the parameter renewal unit 23, andthe parameter output unit 24. Inasmuch as operation of the probabilisticdistribution estimation apparatus 2 under the control of theprobabilistic distribution estimation program 100 is similar to that ofthe probabilistic distribution estimation unit 2 according to the firstembodiment of this invention, the detailed description thereof will beomitted

Ninth Embodiment

Referring to FIG. 16, the description will proceed to a probabilisticdistribution estimation apparatus 4 according to a ninth embodiment ofthis invention. The probabilistic distribution estimation apparatus 4according to the ninth embodiment of this invention is similar instructure and operation to the probabilistic distribution estimationapparatus 3 illustrated in FIG. 3 except that the illustratedprobabilistic distribution estimation apparatus 4 further comprises aprobabilistic distribution estimation program 200. Therefore, the samereference numerals are attached to similar components and the detaileddescription thereof is omitted.

The probabilistic distribution estimation program 200 is read orinstalled in the probabilistic distribution estimation apparatus 4implemented by a computer and controls operation of the probabilisticdistribution estimation apparatus 4 as the certainty calculation unit21, the parameter storage unit 22, the parameter renewal unit 23, theparameter output unit 24, and the session unit 41. Inasmuch as operationof the probabilistic distribution estimation apparatus 4 under thecontrol of the probabilistic distribution estimation program 200 issimilar to that of the probabilistic distribution estimation unit 4according to the second embodiment of this invention, the detaileddescription thereof will be omitted.

Tenth Embodiment

Referring to FIG. 17, the description will proceed to an abnormalbehavior detection apparatus according to a tenth embodiment of thisinvention. The abnormal behavior detection apparatus according to thetenth embodiment of this invention is similar in structure and operationto the abnormal behavior detection apparatus illustrated in FIG. 5except that an abnormal behavior detection program 400 is added to acomputer 300 for realizing the abnormal behavior detection apparatusaccording to the third embodiment of this invention illustrated in FIG.5. Therefore, the same reference numerals are attached to similarcomponents and the detailed description thereof is omitted.

The abnormal behavior detection program 400 is read or installed in theabnormal behavior detection apparatus implemented by the computer 300and controls operation of the abnormal behavior detection apparatus asthe probabilistic distribution estimation apparatus 2 or 4 and the stateestimation unit 5. Inasmuch as operation of the abnormal behaviordetection apparatus under the control of the abnormal behavior detectionprogram 400 is similar to that of the abnormal behavior detectionapparatus according to the third embodiment of this invention, thedetailed description thereof will be omitted.

Eleventh Embodiment

Referring to FIG. 18, the description will proceed to an abnormalbehavior detection apparatus according to an eleventh embodiment of thisinvention. The abnormal behavior detection apparatus according to theeleventh embodiment of this invention is similar in structure andoperation to the abnormal behavior detection apparatus illustrated inFIG. 7 except that an abnormal behavior detection program 600 is addedto a computer 500 for realizing the abnormal behavior detectionapparatus according to the fourth embodiment of this inventionillustrated in FIG. 7. Therefore, the same reference numerals areattached to similar components and the detailed description thereof isomitted.

The abnormal behavior detection program 600 is read or installed in theabnormal behavior detection apparatus implemented by the computer 500and controls operation of the abnormal behavior detection apparatus asthe probabilistic distribution estimation apparatus 2 or 4 and theabnormal detection unit 6 including the abnormal behavior degreecalculation unit 61. Inasmuch as operation of the abnormal behaviordetection apparatus under the control of the abnormal behavior detectionprogram 600 is similar to that of the abnormal behavior detectionapparatus according to the fourth embodiment of this invention, thedetailed description thereof will be omitted.

Twelfth Embodiment

Referring to FIG. 19, the description will proceed to an abnormalbehavior detection apparatus according to a twelfth embodiment of thisinvention. The abnormal behavior detection apparatus according to thetwelfth embodiment of this invention is similar in structure andoperation to the abnormal behavior detection apparatus illustrated inFIG. 9 except that an abnormal behavior detection program 800 is addedto a computer 700 for realizing the abnormal behavior detectionapparatus according to the fifth embodiment of this inventionillustrated in FIG. 9. Therefore, the same reference numerals areattached to similar components and the detailed description thereof isomitted.

The abnormal behavior detection program 800 is read or installed in theabnormal behavior detection apparatus implemented by the computer 700and controls operation of the abnormal behavior detection apparatus asthe probabilistic distribution estimation apparatus 2 or 4 and theabnormal detection unit 7 including the abnormal behavior degreecalculation unit 61 and the behavior model variation degree calculationunit 71. Inasmuch as operation of the abnormal behavior detectionapparatus under the control of the abnormal behavior detection program800 is similar to that of the abnormal behavior detection apparatusaccording to the fifth embodiment of this invention, the detaileddescription thereof will be omitted.

Thirteenth Embodiment

Referring to FIG. 20, the description will proceed to an abnormalbehavior detection apparatus according to a thirteenth embodiment ofthis invention. The abnormal behavior detection apparatus according tothe thirteenth embodiment of this invention is similar in structure andoperation to the abnormal behavior detection apparatus illustrated inFIG. 11 except that an abnormal behavior detection program 1000 is addedto a computer 900 for realizing the abnormal behavior detectionapparatus according to the sixth embodiment of this inventionillustrated in FIG. 11. Therefore, the same reference numerals areattached to similar components and the detailed description thereof isomitted.

The abnormal behavior detection program 1000 is read or installed in theabnormal behavior detection apparatus implemented by the computer 900and controls operation of the abnormal behavior detection apparatus asthe probabilistic distribution estimation apparatus 2 or 4, theposteriori probability calculation unit 8, the reference data input unit9, and the posteriori probability variation degree calculation unit 10.Inasmuch as operation of the abnormal behavior detection apparatus underthe control of the abnormal behavior detection program 1000 is similarto that of the abnormal behavior detection apparatus according to thesixth embodiment of this invention, the detailed description thereofwill be omitted.

Fourteenth Embodiment

Referring to FIG. 21, the description will proceed to an abnormalbehavior detection apparatus according to a fourteenth embodiment ofthis invention. The abnormal behavior detection apparatus according tothe fourteenth embodiment of this invention is similar in structure andoperation to the abnormal behavior detection apparatus illustrated inFIG. 13 except that an abnormal behavior detection program 1200 is addedto a computer 1100 for realizing the abnormal behavior detectionapparatus according to the seventh embodiment of this inventionillustrated in FIG. 13. Therefore, the same reference numerals areattached to similar components and the detailed description thereof isomitted.

The abnormal behavior detection program 1200 is read or installed in theabnormal behavior detection apparatus implemented by the computer 1100and controls operation of the abnormal behavior detection apparatus asthe plurality of probabilistic distribution estimation apparatuses 2 or4 and the information amount standard calculation unit 11. Inasmuch asoperation of the abnormal behavior detection apparatus under the controlof the abnormal behavior detection program 1200 is similar to that ofthe abnormal behavior detection apparatus according to the seventhembodiment of this invention, the detailed description thereof will beomitted.

EXAMPLES

Now, the description will proceed to an example of the probabilisticdistribution estimation apparatus (2 in FIG. 1) and a probabilisticdistribution estimation method according to the first embodiment of thisinvention. In the example, the description will be made in assuming thatthe data is the discrete vector data and the probabilistic distributionis the finite mixed distribution of the hidden Marcov model. One inputdata is one where a command history of a user is recorded everypredetermined time interval. The input data is obtained from the inputunit 1. Each input data may has a different length. In the probabilisticdistribution estimation apparatus 2, one input data is, for example,“(cd, ls, cp, . . . )” and “cd”, “ls”, and so on are symbols y₁, y₂ ofthe input data, respectively. In this event, the hidden variable of thehidden Marcov model is a cluster obtained by gathering similar ones fromthe respective commands. In the parameters of the hidden Marcov model, γrepresents the initial probability of the clusters, a represents thetransition matrix between the clusters, and b represents a conditionalprobability of the symbol of the input data in the clusters.

Now, the description will proceed to an example of the probabilisticdistribution estimation apparatus (4 in FIG. 3) and a probabilisticdistribution estimation method according to the second embodiment ofthis invention. In the example, it will be assumed that the input datais data where execution time of commands and the commands are recordedsuch as “13:40:01 cd, 13:40:02 ls, 13:41:21 cp, . . . , 13:45:33netscape, 13:45:37 netscape, . . . .” In this event, the session unit(41 in FIG. 3) converts the input data into discrete vector data havingan input data format by means so as to divide the input data by thepredetermined time interval such as “(cd, ls, cp, . . . )”, “(netscape,netscape).”

Referring new to FIG. 22, the description will proceed to an example ofthe abnormal behavior detection apparatus (FIG. 5) according to thethird embodiment of this invention. In this embodiment, it will beassumed that the probabilistic distribution estimation apparatus (2 inFIG. 1) according to the first embodiment or the probabilisticdistribution estimation apparatus (4 in FIG. 4) according to the secondembodiment estimates the parameters of the probabilistic distributionfrom user's past command history data “(cd, ls, cp, . . . ), (netscape,netscape), . . . ” and current input data is one input data “(ps, tcsh,tcsh, . . . )” indicative of command history where the user currentlyexecutes. In this event, the state estimation unit (5 in FIG. 5)calculates the certainty indicating that the input data generates fromthe hidden Marcov model having the learned finite mixed distribution toproduce the certainty as the state estimated score. It is possible tocalculate that current command history generates from the hidden Marcovmodel among the respective hidden Marcov models indicative of severalcommand patterns where the user executes. Specifically, as shown in FIG.22, the state estimation unit 5 probabilistically calculates similarityof the pattern indicative of each hidden Marcov model of the finitemixed distribution in the command history or records where the usercurrently inputs. Each pattern in FIG. 22 is actually represented usingthe parameters of the hidden Marcov model such as the respective initialprobability or the probabilistic transition matrix. By calculating thecertainty where the hidden variables of each hidden Marcov model takethe corresponding state by the state estimation unit (5 in FIG. 5), itis possible to recognize that individual command where the user executesgenerates from the state among the respective states indicative of a setof commands. For example, it will be assumed that commands such as mv,cp, mkdir, and so on, which are commands for editing a file or adirectory, constitute a set of commands. It is possible by the stateestimation unit (5 in FIG. 5) to catch a phenomenon so as to edit thefile as well as individual command.

Now, the description will proceed to an example of the abnormal behaviordetection apparatus (FIG. 7) according to the fourth embodiment of thisinvention. In this example, it will be assumed that the probabilisticdistribution estimation apparatus (2 in FIG. 2) according to the firstembodiment or the probabilistic distribution estimation apparatus (4 inFIG. 4) according to the second embodiment estimates the parameters ofthe probabilistic distribution from user's past command history data“(cd, ls, cp, . . . ), (netscape, netscape), . . . ” and current inputdata is one input data “(ps, tcsh, tcsh, . . . )” indicative of commandhistory where the user currently executes. In this event, theabnormality detection unit (6 in FIG. 7) produces an abnormal degree ofthe input data to determine that the input data is abnormal when theabnormal degree is large.

Now, the description will proceed to an example of the abnormal behaviordetection apparatus (FIG. 9) according to the fifth embodiment of thisinvention. In this example, it will be assumed that the probabilisticdistribution estimation apparatus (2 in FIG. 2) according to the firstembodiment or the probabilistic distribution estimation apparatus (4 inFIG. 4) according to the second embodiment estimates the parameters ofthe probabilistic distribution from user's past command history data“(cd, ls, cp, . . . ), (netscape, netscape), . . . ”, current input datais one input data “(ps, tcsh, tcsh, . . . )” indicative of commandhistory where the user currently executes, and past input data areseveral input data “(netscape, netscape, . . . ), (tcsh, tcsh, . . . )indicative of command history where the user executes an intervalbetween the current and nearly past. In this event, the abnormalitydetection unit (7 in FIG. 9) produces the variation degree of thebehavior model that indicates a variation degree of a current user'sbehavior to determine that the input data is abnormal when the variationdegree is large.

Now, the description will proceed to an example of the abnormal behaviordetection apparatus (FIG. 11) according to the sixth embodiment of thisinvention. In this example, it will be assumed that the probabilisticdistribution estimation apparatus (2 in FIG. 2) according to the firstembodiment or the probabilistic distribution estimation apparatus (4 inFIG. 4) according to the second embodiment estimates the parameters ofthe probabilistic distribution from user's past command history data“(cd, ls, cp, . . . ), (netscape, netscape), . . . ” and current inputdata is one input data “(ps, tcsh, tcsh, . . . )” indicative of commandhistory where the user currently executes. In this event, the referencedata input unit (9 in FIG. 11) inputs several input data indicative ofcommand history where the user executes from the current to nearly past.The posteriori probability calculation unit (8 in FIG. 11) calculatesthe posteriori probability of the reference data and the posterioriprobability of the current input data. The posteriori probabilityvariation degree calculation unit (10 in FIG. 11) calculates a variationbetween the above-mentioned two posteriori probabilities as thevariation degree of the posteriori probability. It is possible todetermine whether or not the probabilistic distribution internallychanges by observing whether or not a current user's behavior has astate corresponding to the hidden variable different from those in pastusing the variation degree of the posteriori probability.

The abnormal behavior detection apparatus according to the sixthembodiment of this invention is especially effective in a case oftreating a plurality of programs or data in which user data is mixedtherewith. New, the description will proceed to an example of theabnormal behavior detection apparatus according to the sixth embodimentof this invention in a case where a plurality of user data are obtained.It will be assumed that there are a plurality of user's past commandhistory data “user 1: (cd, ls, cp, . . . ), user 2: (mail, netscape,netscape, . . . ), user 1: (netscape, netscape), . . . . In this event,the probabilistic distribution estimation apparatus (2 in FIG. 1)according to the first embodiment or the probabilistic distributionestimation apparatus (4 in FIG. 3) according to the second embodimentestimates the parameters of the probabilistic distribution from theplurality of user's past command history data “user 1: (cd, ls, cp, . .. ), user 2: (mail, netscape, netscape, . . . ), user 1: (netscape,netscape), . . . . In addition, it will be assumed that current inputdata is one input data “(ps, tcsh, tcsh, . . . )” indicative of acommand history where the current user 1 executes. In this event, thereference data input unit (9 in FIG. 11) inputs, as the reference data,data where several past data of the user 1 are gathered. The posterioriprobability calculation unit (8 in FIG. 11) calculates the posterioriprobability of the reference data and the posteriori probability ofcurrent data of the user 1. The posteriori probability variation degreecalculation unit (10 in FIG. 11) calculates variation of theabove-mentioned two posteriori probabilities as the variation degree ofthe posteriori probability to produce the abnormal degree of the inputdata using it. It is determined that the input data is abnormal when thevariation degree of the posteriori probability is large.

Now, the description will proceed to an example of the abnormal behaviordetection apparatus (FIG. 13) according to the seventh embodiment ofthis invention. In this example, it will be assumed that the pluralityof the probabilistic distribution estimation apparatuses (2 in FIG. 2)according to the first embodiment or the probabilistic distributionestimation apparatuses (4 in FIG. 4) according to the second embodimentestimate, in parallel, the parameters of the probabilistic distributionfrom user's past command history data “(cd, ls, cp, . . . ), (netscape,netscape), . . . ”, for instance, in a case where the number of thehidden Marcov models of the finite mixed distribution is changed. Byusing the parameters of the estimated probabilistic distributions, theinformation amount standard calculation unit (11 in FIG. 13) calculatesstandard of the information amount for the respective probabilisticdistributions. In this event, the number of the hidden Marcov modelswhere the standard value of the information amount is least is a currentoptimum cluster number. In addition, it will be assumed that currentinput data is one input data “(ps, tcsh, tcsh, . . . )” indicative ofcommand history where the user currently executes. This data is suppliedto the above-mentioned probabilistic distribution estimation apparatuses2 or the above-mentioned probabilistic distribution estimationapparatuses 4 and then estimation of the parameters and calculation ofthe standard of the information amount are carried out in parallelagain. In this event, by observing whether or not the optimum clusternumber changes, it is possible to catch a structural variation of themodel indicative of generation of a new behavior pattern ordisappearance of the behavior pattern. When the number of the stateswhere the hidden variables can take changes, it is possible by theinformation amount standard calculation unit (11 in FIG. 13) to catchnot only generation or disappearance of behavior where a chain ofcommands means but also generation or disappearance of a set ofindividual commands. Specifically, it is possible to catch, in timeseries fashion, appearance or disappearance of a set of commends thatindicates commands such as mv, cp, mkdir, or the like which are, forinstance, commands for editing a file or a directory.

Besides an example of a pretending detection which is described above,there are applications such as an invasion detection using a system callpattern where a program internally executes, a doubtful customer'sbehavior detection using reading history of Web, a network failuredetection using an alarm message, and so on.

It will be assumed that the input data is a series of system calls. Inthis event, the abnormality detection unit (6 in FIG. 7) detects, as theoutlier value, the system call pattern when there is an invasion in thesystem call pattern in which a normal program executes. That is,application is made about the invasion detection. By using theabnormality detection unit (7 in FIG. 9) for the data in question, it ispossible to detect a condition where the system call patterncontinuously changes on a large scale due to invasion.

It will be assumed that the input data is data where reading historiesof Web in a plurality of users are mixed. In this event, by using theposteriori probability variation degree calculation unit (10 in FIG. 11)with attention to one customer, it is possible to detect an individualbehavior variation so that the customer reads in a way different frompast although behavior of the customer in question is not abnormal amongall of customers. In addition, by using the information amount standardcalculation unit (11 in FIG. 13) for this input data, it is possible todetect a new behavior pattern among all of customer's behavior patternsthat occurs due to a change in a design of Web page.

Now, the description will be made assuming that the input data iscontinuous vector data and the probabilistic distribution is the finitemixed distribution of the hidden Marcov model having the continuous timedistribution and the autoregressive model corresponding to each state.For example, the input data represents resource used amount inperformance evaluation of a computer or performance analysis of anetwork.

It will be assumed that one behavior data is data obtained by dividingnumerical data observed time series such as an activity ratio of a CPU,a consumed amount of a memory, or the like by an unit of a predeterminedtime interval such as a day of week, a time zone, or the like. When thestate estimation unit (5 in FIG. 5) calculates the certainty indicatingthat the input data generates from the hidden Marcov model in the finitemixed distribution, it is possible to know that a current locus appliesto a pattern among several types of patterns of the locus. When thestate estimation unit (5 in FIG. 5) calculates the certainty indicatingthat the input data generates from a state corresponding to the hiddenvariable in each hidden Marcov model, it is possible to know that aparticular position of the current locus applies to a pattern. By usingthe hidden Marcov model having the continuous time distribution, it ispossible to realize robust state estimation with elasticity in atemporal direction tinged

By using the abnormality detection unit (6 in FIG. 7), it is possible todetect a locus having an abnormal pattern which is not applied to any ofnormal patterns of a plurality of loci in the manner as shown in FIG.23.

By using the abnormality detection unit (7 in FIG. 9), it is possible todetect a condition where a pattern of the activity ratio of the CPUcontinuously changes on a large scale due to failure in comparison witha past pattern.

In addition, it will be assumed that there is a condition so as toobserve the activity ratio of the CPU in a plurality of computers. Inthis event, by using the posteriori probability variation degreecalculation unit (10 in FIG. 11), when attention is directed to aparticular computer, it is possible to detect a condition that a locushaving a pattern absent in the past is observed in the particularcomputer although the pattern in question is not abnormal among all ofpatterns.

When the information amount standard calculation unit (11 in FIG. 13)calculates the optimum distribution number of the finite mixeddistributions in time series fashion, it is possible to detectgeneration of a new locus pattern or disappearance of the locus patternwith its concrete characteristic. Furthermore, when the informationamount standard calculation unit (11 in FIG. 13) calculates the optimumcontinuous time interval and the number of the states where the hiddenvariables can take, it is possible to grasp, as a part of the locus,generation of a new characteristic pattern or disappearance of thepattern.

Besides the examples of activity ratio of the CPU which is describedabove, application examples using the continuous data may beapplications such as signature authentication, a moving body analysisusing a dynamic image of a video image or the like, and so on.

In a case of, for instance, the signature authentication, it ispossible, by using the abnormality detection unit (6 in FIG. 7), tojudge whether or not the signature is signature by the person inquestion from numerical data recording operation of a hand on signing.

In a case of, for instance, the moving body analysis using the dynamicimage of the video image or the like, it is possible, by the informationamount standard calculation unit (11 in FIG. 13), to grasp generation ofa new characteristic behavior pattern or disappearance of the behaviorpattern from numerical data indicative of behavior.

While this invention has thus far been described in conjunction withseveral embodiments thereof, it will readily be possible for thoseskilled in the art to put this invention into practice in various othermanners.

1. A probabilistic distribution estimation apparatus for responding to,as input data, a string of vector data to estimate a probabilisticdistribution occurred in each data by successively reading said stringof vector data, said probabilistic distribution estimation apparatuscomprising: a parameter storage unit for storing all of parameters forthe stochastic model having the hidden variables; certainty calculationmeans for calculating, in response to said input data, a certainty wheresaid input data occurs using said stochastic model by reading theparameters of said stochastic model from said parameter storage unit;parameter renewal means for renewing contents of said parameter storageunit in accordance with new read data with past data forgotten byreading the certainty from said certainty calculation means and byreading each parameter of said stochastic model from said parameterstorage unit; and outputting means for outputting several parameters ofsaid stochastic model stored in said parameter storage unit.
 2. Aprobabilistic distribution estimation apparatus as claimed in claim 1,wherein further comprises session means for processing the input datainto the string of vector data, and wherein a stochastic model havinghidden variables is used to estimate the probabilistic distributionoccurred in each data.
 3. A probabilistic distribution estimationapparatus according to claim 1, wherein a time series model having acontinuous time distribution and hidden variables is used to estimatethe probabilistic distribution occurred in each data.
 4. A probabilisticdistribution estimation apparatus according to claim 1, wherein a finitemixed distribution of hidden Markov models each having a continuous timedistribution is used to estimate the probabilistic distribution occurredin each data.
 5. An abnormal behavior detection apparatus according toclaim 1, wherein a finite mixed distribution of hidden Markov models isused to estimate the probabilistic distribution occurred in each data.6. An abnormal behavior detection apparatus according to claim 5,further comprising: session means for processing the input data into thestring of vector data.
 7. A method of estimating a probabilisticdistribution, comprising the steps of: inputting a string of vector dataas input data; calculating, using a model in which each data occurs bysuccessively reading the string of vector data, a certainty for a valueof the input data in which said input data occurs on the basis ofparameters of said stochastic model; renewing, by using said certaintyand the parameters of said stochastic model, the parameters in responseto new read data with past data forgotten; and outputting several valuesof the calculated parameters.
 8. A method as claimed in claim 7, whereinfurther comprising the step of carrying out session for converting saidinput data into the vector data when said input data has no structure ofvector data, and wherein the model is a stochastic model having hiddenvariables as a probabilistic distribution.
 9. A method of estimating aprobabilistic distribution according to claim 7, wherein the model usedin the calculating step is a time series model having a continuous timedistribution and hidden variables as a probabilistic distribution.
 10. Amethod as claimed in claim 9, wherein further comprising the step ofcarrying out session for converting said input data into the vector datawhen said input data has no structure of vector data.
 11. A method ofestimating a probabilistic distribution according to claim 7, whereinthe model used in the calculating step is a finite mixed distribution ofhidden Markov models having a continuous time distribution as aprobabilistic distribution.
 12. A method as claimed in claim 11, whereinfurther comprising the step of carrying out session for converting saidinput data into the vector data when said input data has no structure ofvector data.
 13. A method of detecting abnormal behavior according toclaim 7, wherein the outputting step comprises the step of: outputting,by using parameters of an estimated probabilistic distribution, as ascore, the certainty where new read data has a state corresponding toeach hidden variable.
 14. A method of detecting abnormal behavioraccording to claim 7, further comprises the step of: carrying outsession for converting the input data into a string of vector data whensaid input data have no structure of vector data.
 15. A probabilisticdistribution estimation program for making a computer respond to, asinput data, a string of vector data to estimate a probabilisticdistribution occurred in each data by successively reading said stringof vector data, said probabilistic distribution estimation programmaking said computer operate as: a parameter storage unit for storingall of parameters for the stochastic model having the hidden variables;certainty calculation means for calculating, in response to said inputdata, a certainty where said input data occurs using said stochasticmodel by reading the parameters of said stochastic model from saidparameter storage unit; parameter renewal means for renewing contents ofsaid parameter storage unit in accordance with new read data with pastdata forgotten by reading the certainty from said certainty calculationmeans and by reading each parameter of said stochastic model from saidparameter storage unit; and outputting means for outputting severalparameters of said stochastic model stored in said parameter storageunit.
 16. A probabilistic distribution estimation program as claimed inclaim 15, wherein said probabilistic distribution estimation programfurther makes said program operate as session means for processing theinput data into the string of vector data, and wherein a stochasticmodel having hidden variables is used to estimate the probabilisticdistribution occurred in each data.
 17. A probabilistic distributionestimation program according to claim 15, wherein a time series modelhaving a continuous time distribution and hidden variables is used toestimate the probabilistic distribution occurred in each data.
 18. Aprobabilistic distribution estimation program as claimed in claim 17,wherein said probabilistic distribution estimation program further makessaid program operate as session means for processing the input data intothe string of vector data.
 19. A probabilistic distribution estimationprogram according to claim 15, wherein a finite mixed distribution ofhidden Markov models each having a continuous time distribution is usedto estimate the probabilistic distribution occurred in each data.
 20. Aprobabilistic distribution estimation program as claimed in claim 19,wherein said probabilistic distribution estimation program further makessaid program operate as session means for processing the input data intothe string of vector data.